Website Backups: The 3-2-1 Rule and Testing a Restore

A good website backup follows the 3-2-1 rule — three copies of your data, on two different kinds of storage, with one copy kept off-site — includes both the site's files and its database, keeps several points in time, and has been restored at least once to prove it works. A backup nobody has ever restored is not yet a backup; it is a hope.

What can go wrong without one

• An update to a plugin or theme breaks the site, and the old version is gone.
• Somebody deletes the wrong folder, or overwrites the database.
• The site is hacked, and the attacker's changes are found only weeks later.
• A disk fails, or a server is lost.
• You lose access to the account itself — a forgotten password, a dispute, a payment problem.

Each needs a different copy to recover from: one from just before the change, one from before the hack, one that is not on the same server, one that is not in the same account.

The 3-2-1 rule, for a website

• Three copies: the live site, plus two backups.
• Two kinds of storage: for example, your host's backup storage and your own computer or cloud storage.
• One off-site: at least one copy somewhere your hosting account cannot reach, so a problem with the account, the server or the host cannot take every copy at once.

What to include

• Files: your site's code, theme and plugins, and everything visitors or you have uploaded (images, documents).
• The database: posts, pages, products, orders, users, settings. For WordPress and most content systems, this is where the content actually is.
• Email, if your mailboxes are on the same hosting.
• Configuration: files such as wp-config.php or .env, and a note of your DNS records.

Files and database must be from the same moment. Restoring this week's files with last month's database (or the other way round) usually gives a broken site.

How often, and how many to keep

Ask yourself how much work you could afford to lose. A shop that takes orders every hour needs at least daily backups; a brochure site that changes once a month can live with weekly ones plus a backup after every change. Keep several points in time — yesterday's, last week's, last month's — because problems are often found late, and yesterday's backup may already contain them. And always take a backup right before a big change: a core update, a new plugin, a theme switch.

Test a restore before you need one

A backup can be incomplete, corrupted or missing the database without anybody noticing until the day it is needed. A few times a year:

1. Restore a backup to a separate place — a test subdomain or a separate folder and database — not over the live site.
2. Open the restored copy and check that pages, images and recent content are there, and that you can sign in.
3. Note how long it took. That is how long your site would be down on a bad day.

Restoring after a hack

Restore to a point before the attack, and then close the door it came through: update the content system, its plugins and themes, remove any you do not use, and change every password — hosting panel, database, admin users, FTP, email. Otherwise the same hole is used again within days.

Backups at Hostular

As of November 2026, every Hostular plan keeps a number of backups of your account, shown on each plan on the pricing page. Backups are encrypted, and one counts only once it has been read back and checked; one that cannot be is recorded as failed, not kept as a backup. You start a backup and restore your files yourself from the panel, and a copy of the current state is taken first, so a restore can itself be undone.

Those backups live with your hosting. To complete the 3-2-1 rule, keep a copy of your own somewhere else as well:

1. In the browser terminal, export the database: mysqldump -u your_db_user -p your_db_name > site-db.sql (it asks for that database user's password).
2. In the file manager, compress your site's folder — and the site-db.sql file — into one archive.
3. Download the archive to your computer or cloud storage, and delete the copy from the server.

Running WordPress? Do this before every major update. If you are setting it up for the first time, see how to install WordPress yourself, and keep your site on HTTPS with a free SSL certificate.