A WordPress backup has two components: the files (themes, plugins, media) and the database, which holds the content and settings. It must be automatic, kept off the site's server and regularly tested by a restoration, because an unverified backup is not reliable.