Why two backups are better than one

Updated: Oct 28, 2026

A single backup can fail at the same time as the original through theft, fire, ransomware, account deletion or a simple storage error. Independent copies reduce the chance that one event destroys every version. That sentence is easy to agree with and easy to ignore, so this article looks at the concrete ways a lone backup lets people down and what a realistic second copy looks like for a home user, a freelancer or a small website.

How a single backup fails together with the original

A backup protects you against a specific set of failures. The trouble with having exactly one is that many common failures hit the original and the backup together.

• Same device. A copy in another folder on the same laptop protects against accidentally editing the wrong file, and nothing else. If the drive dies or the laptop is stolen, both copies go with it.
• Same location. An external drive on the desk next to the computer survives a disk failure but not a flood, a fire or a burglary.
• Same account. A cloud folder is convenient, but if your account is locked, phished or closed, the files inside are as unreachable as the ones on your machine.
• Same sync logic. A synchronised folder mirrors deletions and encryption. When ransomware encrypts your documents, the sync client dutifully uploads the encrypted versions, and if the service keeps only a short version history, the clean copies age out before you notice.
• Same medium. Two USB sticks from the same batch, or two drives in one enclosure, can fail in similar ways at similar times.

Two backups that share a failure mode are barely better than one. Two backups that fail for different reasons are a real improvement, because an event that destroys one is unlikely to destroy the other.

The 3-2-1 rule as a starting point

A popular rule of thumb is 3-2-1: keep three copies of important data, on two different kinds of storage, with one copy kept somewhere else. For a household that could mean the working files on the computer, an encrypted external drive that is updated weekly, and an online backup service that runs automatically. Each copy fails differently: the drive can be lost, the online account can be locked, the laptop can break, but a single event rarely takes out all three.

Two refinements are worth adding. First, at least one copy should be offline or immutable: a drive that is unplugged between backups, or a cloud bucket with object locking, cannot be encrypted by malware running on your computer. Second, keep several generations, not only the latest. If a file was corrupted three weeks ago, a backup that contains only yesterday’s state has faithfully preserved the corruption.

What a second backup means for a website

People who run a small site often assume the hosting provider’s backup is enough. It is a good first copy and a poor only copy: it lives in the same account, follows the provider’s retention schedule, and disappears if the account is suspended. A complete second copy of a website includes:

• the database export, not just the files;
• uploaded media, which are often larger than everything else combined;
• code and theme customisations, ideally in version control;
• configuration and secrets: environment files, DNS records, TLS settings, cron jobs;
• a written recovery procedure that says, in order, how to bring the site back on a fresh server.

Store that second copy somewhere the hosting account cannot touch: a personal cloud drive, a home NAS, or a different provider. Automate it; a backup that depends on remembering to run a script is a backup that will be three months old when you need it.

Building a simple two-copy routine

• Ask of every copy: “what event would destroy this and the original at the same time?” If the answer is the same for both copies, they are not independent.
• Keep at least one copy that is offline or cannot be overwritten by the device you work on.
• Retain history. Daily copies for a couple of weeks plus a few monthly snapshots catch problems you discover late.
• Encrypt backups that leave your control, and store the encryption key separately from the backup itself.
• Test a restore periodically. Pick a file at random and bring it back; for a website, rebuild it once on a test server.

Frequently asked questions

Is cloud sync a backup?

Only partly. It protects against hardware failure but faithfully copies deletions and ransomware damage. Treat it as one copy and pair it with something independent.

How often should I back up?

As often as you can afford to lose work. Daily is typical for documents; continuous for anything you cannot recreate. Automated tools make frequency a setting rather than a chore.

Do I need to back up everything?

No. Prioritise what cannot be downloaded again: photos, documents, databases, keys, configuration. Operating systems and applications can be reinstalled.

Redundancy is about different failure modes, not simply counting folders.

In short: One backup shares too many risks with the original. A second copy on different media, in a different place and outside the reach of your everyday account is what turns “I have a backup” into “I can recover”.