Website Backups: The 3-2-1 Rule — and How to Test Restores

Most website owners only discover their backup is broken when they need it. Learn the 3-2-1 backup rule, how to test restores, and build an automated backup system that actually works.

Why backups fail when you need them

A backup that cannot be restored is not a backup, it is a false sense of security. The most common reasons backups fail are equally mundane: the backup script ran out of disk space and completed silently with a partial file; the FTP credentials changed and the remote backup has been failing for months but nobody checked; the backup format is proprietary and the restore tool no longer exists; or the backup includes only the files and not the database, or vice versa.

The result is always the same: when the site crashes, you discover the backup is useless. The only way to prevent this is to treat backup testing as a core part of your maintenance routine, not an afterthought.

The 3-2-1 rule explained

The 3-2-1 rule is the industry standard for backup reliability. It states that you should have three copies of your data, on two different types of storage media, with one copy stored off-site.

Three copies means your live site plus two backups. Two different media means not both on the same server — for example, one local file on your hosting account and another on cloud storage or an external drive. One off-site means a copy that survives a physical disaster at your hosting provider's data centre.

For a typical Bahrain business, this looks like: a daily automated backup to cloud storage (off-site), a weekly manual backup downloaded to your local machine, and a monthly archive kept on a separate drive. Together, these three copies cover hardware failure, accidental deletion, ransomware, and data centre outages.

Backup methods: cPanel, plugins and server-level

There are three main approaches to backing up a website, each with different trade-offs between convenience, reliability and cost.

cPanel backups are the most accessible. Most Bahrain hosting providers include cPanel with built-in backup tools. You can generate a full backup — files, databases, email filters — and download it to your computer. The downside is that cPanel backups are manual unless you pay extra for automated off-site storage. If you forget to run it, you have no backup.

Backup plugins like UpdraftPlus, BackupBuddy or VaultPress automate the process from inside your CMS. They can send copies to Google Drive, Dropbox or S3-compatible storage on a schedule you define. The trade-off is that the plugin runs on your server, so if the server is compromised, the backup might be compromised too.

Server-level backups are the most reliable and the most invisible. The hosting provider takes snapshots of the entire server at regular intervals and stores them independently of your account. At Almada, we take daily server-level backups with 30-day retention and store them in a separate data centre. You can request a restore at any time with a single support ticket.

Restore testing schedule

A backup is only as good as its last successful restore test. Schedule tests at intervals that match your tolerance for data loss.

Run an automated restore test monthly. Restore the most recent backup to a staging subdomain and run through a checklist: does the homepage load, do internal links work, are images displaying, can you log into the admin panel, are recent posts present, do forms submit correctly.

Run a full disaster recovery drill quarterly. Delete the live site entirely and restore it from scratch using only your backup procedure. This exposes every weak link — missing files, expired credentials, incomplete database exports — in a controlled setting rather than during an emergency.

Document every restore test in a simple log: date tested, backup source, any issues found, time to complete. If a test fails, fix the backup process immediately and retest.

Building an automated backup system

Manual backups fail because humans forget. The goal is a system that backs up automatically and alerts you if something goes wrong.

Start with your hosting provider's built-in backup, if it offers automated daily snapshots. That covers the server-level copy. Then add a second automated backup using a plugin or script that sends a copy to cloud storage. This gives you the two copies on two media that the 3-2-1 rule demands.

Configure failure alerts. Both the server backup and the cloud backup should email you or your developer if a backup did not complete. A silent failure that goes unnoticed for months is worse than no backup at all.

Review your backup system every six months. Has the site grown? If the backup file now exceeds your cloud storage quota, it will fail silently. Have you added an e-commerce store? The database backup size has changed and the schedule might need adjusting.

Combine your backup strategy with our security checklist to cover both prevention and recovery. If the worst happens, our hacked recovery guide walks you through the response. And see our maintenance cost guide to understand what ongoing protection costs.