Three copies, two media, one off-site
The old 3-2-1 rule still holds. On shared hosting that usually means the host daily backup, a scheduled export you download, and a copy in cloud storage you control independently of the host.
Test the restore, not the backup
Once a quarter, restore into a subdomain and click through the site. Most failed restores are discovered to be missing the database, missing uploads, or written by a cron that stopped succeeding months earlier.
What to keep and for how long
Daily for a fortnight, weekly for a quarter, monthly for a year is enough for most businesses. Longer retention matters when the damage is silent — a corrupted import discovered six weeks later needs a copy from before it happened.
