Or a step further: don't let either the live and backup sites connect to each other directly, instead use an intermediary site that both connect to (which can not connect back to them).