How often, by type of site
- Online store or booking site: daily at minimum, often hourly for the database, because every order is data you cannot recreate.
- Business site with a blog or regular updates: daily.
- Brochure site that changes a few times a year: weekly is enough, plus a backup before each change.
- Before any update, migration or redesign work: always, manually, right before you start.
What makes a backup worth having
- Complete: both the files (theme, plugins, uploads) and the database (pages, posts, orders, settings). Many 'backups' are one without the other.
- Off-server: stored in Google Drive, Dropbox, Amazon S3 or the backup provider's storage. A backup on the same server as the site disappears with the server.
- Automatic: scheduled, not dependent on someone remembering.
- Versioned: several points in time, not one that is overwritten, so you can go back to before a hack that was discovered a week late. Keep 30 days or more.
- Tested: restore one to a staging site twice a year to confirm it actually works.
- Yours: you should be able to download a copy, not just your developer or host.
Does my host back up my site?
Many do, and it is worth knowing exactly what theirs covers: how often, how long they keep it, whether you can restore it yourself and whether it is on the same hardware. Treat the host's backup as a second copy, not the only one. Managed WordPress hosts and platforms such as Shopify handle backups well; cheap shared hosting often promises them and delivers something slow or incomplete. A plugin (UpdraftPlus, BlogVault, Jetpack Backup) or a maintenance plan gives you a copy under your own control. Backups are the first item in what website maintenance includes for a reason.