A second site without a traffic decision point is just a cold spare you hope someone remembers. Real redundancy needs an active fail path: health checks that remove a bad origin, a load balancer or DNS failover that clients actually follow, and a tested cutover — not three racks that all depend on the same manual runbook.

What I verify before calling a layout HA: each site can serve alone under expected load, session and cache state survive a fail, TLS and Host headers stay consistent after the switch, and the health probe fails closed on partial outages (app up but upstream DB dead). If failover still needs a human to edit A records at 3am, you have geographic diversity, not high availability.