More than most people include.
THE WEBSITE
All files in the web directory: application code, themes, plugins, uploads and media.
THE DATABASE
Where your content, settings, users, orders and everything else lives. A file backup without the database restores an empty shell.
Mailboxes, which for most businesses are as valuable as the website. Frequently forgotten entirely.
CONFIGURATION
Cron jobs DNS records, particularly if hosted externally Email accounts and forwarders SSL certificates, if manually installed Redirects and .htaccess rules PHP version and settings
THINGS OUTSIDE THE ACCOUNT
Domain registration details Third-party service credentials Payment gateway configuration Anything stored with an external provider
WHAT A PLUGIN BACKUP USUALLY COVERS
The website files and database only. Not email, not cron jobs, not other sites on the account.
THE PRACTICAL ANSWER
A full cPanel account backup covers most of it. Add a note of the things that live outside the account.