Everything a WordPress site needs.
WHAT MUST BE INCLUDED
The database, which holds posts, pages, settings, users, comments and plugin data wp-content, which holds themes, plugins and uploads wp-config.php, which holds the database credentials and any custom constants .htaccess, which holds rewrite rules and any redirects
WHAT DOES NOT NEED BACKING UP
WordPress core files, which can be downloaded fresh from the official source. Including them is harmless and makes archives larger.
THE MINIMUM USEFUL BACKUP
Database plus wp-content. From those two you can rebuild.
THE PRACTICAL APPROACH
A backup plugin sending both to remote storage, with the database daily and files weekly.
Plus a periodic full account backup covering email and everything else.
WHAT PEOPLE MISS
The uploads directory, if a plugin setting excludes it to reduce size. Check what is actually included. wp-config.php, which some tools skip as a configuration file.
VERIFYING
Open the archive and confirm wp-content and a SQL file are present, and that the SQL file is a plausible size.
