The 3-2-1 Backup Rule for Websites

The rule explained, digit by digit

The 3-2-1 Backup Rule for Websites from WebJi®, billed in INR with 18% GST on the invoice. Email support@webji.services is 24/7 in Hindi and English (average first reply under 60 minutes). Phone +91 141 4941811 is business hours only. The company has been in this business since 2005.

Why it still defeats ransomware

Modern ransomware explicitly hunts backups: attackers dwell for days, enumerate storage, and delete or encrypt every copy they can reach with your credentials.

The rule survives because of its structure. Two media means the attack tooling that wipes network shares may not reach the cloud bucket. One offsite means the copy behind different credentials and a different provider needs a separate compromise. And the 3-2-1-1-0 upgrade closes the remaining gap:

1. 1 immutable copy — object-lock storage that nothing, not even your credentials, can alter during retention.
2. 0 errors — restore verification proving the copies actually work.

Ransomware monetises your inability to restore; the rule is how you refuse the negotiation.

Applying 3-2-1 to a WordPress or VPS site

Install WordPress from the one-click installer into the document root you intend to use, not into a surprise subfolder. Note the admin URL and set a real password. Delete the default post and the unused themes after you have logged in.

The 3-2-1-1-0 upgrade

Three copies, two media, one offsite — the oldest rule in data safety, digit by digit:

• Three copies: production plus two backups. One backup is a single point of failure; three make simultaneous loss a coincidence, not a certainty.

• Two different media or systems: disk plus cloud, local plus remote — so one corrupted platform cannot corrupt both copies.

• One offsite: a copy outside the building, the city, ideally the failure domain — because fire, theft and regional outages do not respect server rooms.

The RPO (recovery point objective) you can actually meet is what the rule buys: how much data you can afford to lose, answered in hours instead of weeks. Applied to a WordPress or VPS stack below.

What does not count as a backup copy

The audit list, because bad copies are worse than none:

• Sync services — desktop Drive/Dropbox sync on the server propagates deletions; ransomware with server access corrupts the 'backup' too.

• Backups with delete-capable tokens — if the backup destination holds credentials that can delete it, it is not immutable.

• RAID — protects against a dead disk, not deletion, encryption or fire.

• Snapshots alone — platform snapshots help, but retention is short and they live in the same failure domain.

• The staging copy — it is a deploy target, not a restore point.

A copy counts only when it is independent: different system, different credentials, different location. The backup solutions page builds the stack that passes this audit.

Testing restores

How this plays out with immutable backups: settings that look cosmetic usually decide page speed and uptime under real traffic. The defaults WebJi® ships are tuned for Indian network conditions, and support can review your setup on request.

Cost of a proper setup in INR

The honest budget sheet:

The software layer costs effectively nothing — UpdraftPlus or WP-CLI scripts cover WordPress and server stacks. Money buys the offsite discipline: managed backup plans with retention and monitoring, which is precisely the layer people skip until the day they need it.

WordPress sites start with a plugin — the backup plugin comparison ranks the field.