A backup plan is part of security because recovery matters after mistakes, malware, broken updates, and hosting problems.
Back up both the website files and the database if your site uses one. Saving only the files may not preserve posts, users, settings, or orders.
Keep at least one backup outside your hosting account. If the hosting account is compromised or suspended, backups stored only inside it may disappear with the site.
Test restoration on a staging folder or local copy. A backup that has never been restored is only a hope, not a proven recovery plan.