List what needs to be backed up
A useful WordPress backup includes files, media, theme, plugins and database. Check its frequency with regard to actual changes to the site. A catalog updated every day cannot depend on a copy that is several weeks old without risk of loss.
Carry out a non-production test
Choose a test environment and restore a copy. Check home, login, form and products or reservations if the site has them. Note the time needed and access required. An archive that exists but cannot be restored is not a recovery plan.
Limit the causes of breakdown
Update WordPress and components according to a procedure, remove unused accounts and give minimum rights. Document the contact of the host and the person capable of making the decision for a restoration. Recheck the site after each major intervention.
Source: https://developer.wordpress.org/advanced-administration/security/hardening/.
