For many small and medium-sized businesses, an unavailable or compromised website means direct financial losses: missed orders, lost leads, wasted advertising budget and unnecessary effort for technical support. For this reason, the 3-2-1 backup rule is not an optional “nice-to-have” for small businesses but an indispensable continuity measure that protects cash flow and safeguards the company’s ability to operate.

What does the 3-2-1 rule mean?

3 copies of the data – the original plus two further backup copies
2 different media or storage locations – e.g. web hosting and cloud storage
1 offsite copy – outside the main infrastructure, physically or logically separated

What must a complete backup contain?

Database – products, orders, user accounts, settings, blog articles
Website files – theme, plugins, uploads (images, PDFs, media)
Critical configurations – API keys, cache settings, redirect rules

Understanding RPO and RTO

Two important metrics help you define the backup strategy correctly:

RPO (Recovery Point Objective) – How much data loss can your business tolerate? An RPO of 24 hours means you can accept losing the data of the last 24 hours.
RTO (Recovery Time Objective) – How quickly must your website be back online after an outage? An RTO of 2 hours means the recovery must be completed within 2 hours.

Implementation steps

Take inventory – Identify which data changes daily: orders, leads, newly uploaded files.
Set the frequency – Daily is the minimum recommendation; for e-commerce shops, every 6–12 hours is advisable.
Define the retention period – 7–14 days for current problems; 30 days for incidents that are detected late.
Ensure genuine access separation – For offsite backups, use a separate account with a unique password and two-factor authentication (2FA).
Automate and monitor – Set up automatic backup schedules and get notified by email about success or failure.
Test restoration regularly – Restore the backup in a separate test environment and check the homepage, checkout process and contact forms.

Common mistakes in the backup strategy

Backup exclusively on the same server as the live website
Retention period too short – problems are often noticed only after days
Restoration has never been tested
The database is ignored or not backed up separately
Access protection for backup storage too lax – no 2FA, no account separation

Conclusion

By consistently applying the 3-2-1 backup rule – three copies on two different media, one of them offsite – clearly defining RPO and RTO and regularly testing restoration, you create a realistic continuity system. This system noticeably reduces operational risk and sustainably protects the ROI of your online channels.