Having backups turned on in the hosting panel is good, but it is only part of a complete strategy. The 3-2-1 rule is a simple principle, used long before the cloud existed, that remains the most reliable way to make sure a backup is actually there the day you genuinely need it.
What the rule says
Three total copies of your data. Two different types of storage. One copy kept away from the main location where everything else lives.
It sounds abstract until it is applied to an actual website, so let us translate each part.
Three copies: the original does not count as a backup
The site currently running on the hosting is one copy, the first. It is not a backup: it is the original, and if something happens to it, there is nothing to recover from. The rule asks for two additional copies, beyond the original in production.
The automatic backup the hosting itself creates is the second. It is the most convenient because it generates itself, with nothing for you to remember, and usually allows a fast restore with no external steps.
The third copy is the one almost everyone skips, and it is the most important of the three: a copy downloaded to your own computer or to a storage service independent of the hosting, which you make yourself or schedule to happen automatically, outside the provider's own system.
Two different types of storage: not everything in one place
This part of the rule aims to prevent a single technical failure from wiping out every copy at once. If the original lives on the hosting server and the automatic backup also lives on that same server or in the same data centre, a problem affecting that infrastructure can affect both at the same time.
That is why the third copy, the one you download, needs to sit on genuinely different storage: your computer, an external drive, a cloud storage service that is not the same hosting. Nothing sophisticated is needed, just a location physically and technically separate from the original server.
A copy kept off-site: the point of this rule, summed up
This is the part most people never apply, and it is exactly the one that covers the most serious scenarios. If something happens to the hosting account as a whole (a serious provider issue, human error deleting the entire account, an attack compromising the whole panel), any copies that lived inside that same account are lost along with everything else.
A copy that exists entirely outside the hosting, on your own computer or in a separate storage service, survives whatever happens to the account. It is the difference between a bad day and a total, unrecoverable loss.
What this looks like applied to a real site
Copy 1 (the original): the site running on the hosting, with its current files and database.
Copy 2 (automatic, from the provider): the backups the hosting panel generates on whatever schedule is configured, stored on the provider's own infrastructure.
Copy 3 (external, yours): a full copy downloaded to your computer or uploaded to a cloud storage service separate from the hosting, at a reasonable frequency depending on how often the site changes (monthly for one that barely updates, weekly or even daily for a shop with real activity).
The mistake that makes all of this pointless
Having all three copies is not enough if you have never tested that a restore actually works. It is surprisingly common to discover, at the worst possible moment, that the backup file is corrupted, incomplete, or that nobody remembers how to restore from that specific format.
That is why, beyond the three copies, the rule is completed with one final practice: testing a restore every so often, in an environment separate from the real site, to confirm the backup genuinely works. A backup that has never been tested is not a reliable backup, it is an assumption.
How much real effort this takes
Less than it sounds. The hosting's automatic backup, once configured, needs nothing further. The external copy can be scheduled to download itself at a certain frequency, instead of relying on remembering to do it manually every time. And the restore test does not need doing constantly: once in a while, especially after a big change to the site, is enough to have peace of mind that it will work if it is ever needed.
What to do if you have none of the three today
If reading this made you realise you have no external copy at all, the order to catch up is simple: first confirm the hosting's automatic backup is genuinely turned on, then download a full copy to your computer right now, without waiting to schedule it, and only once that is sorted think about automating the external copy's frequency going forward.
You do not need to solve all three parts of the rule in one perfect day. Even having just one recent external copy already takes you out of the most dangerous scenario, which is having absolutely nothing outside the hosting.
From there, tightening the schedule and testing a restore can wait for a calmer moment. What cannot wait is getting that first external copy made today, before anything happens rather than after.