1. Choose what matters
Include site files, databases and configuration. Some applications need consistent database snapshots, not just a file copy.
2. Separate the copies
Keep at least one copy outside the primary hosting account or machine. A backup on the same disk shares the same risk.
3. Set a retention schedule
Match backup frequency to how much data you can afford to lose. Keep more than one restore point.
4. Test the recovery
Restore to a separate environment, verify content and record how long it takes. Repeat the test after significant application changes.