Code you or a developer wrote.
THE RIGHT TOOL
Version control. A repository records every change with history, and every clone is effectively a backup.
This is better than backups for code, because you can inspect and reverse individual changes.
WHAT STILL NEEDS BACKING UP
The database Uploaded files Configuration containing credentials, which should not be in the repository
WHAT SHOULD BE IN THE REPOSITORY
All application code Configuration templates, with placeholder values Deployment scripts Documentation
WHAT SHOULD NOT
Credentials, ever. They remain in the history even after removal. Uploaded files and media Dependency directories, which are installed rather than committed
IF THERE IS NO REPOSITORY
Then the only copy of the code is on the server, and it must be backed up like anything else.
Setting up a repository is the better answer, and worth doing before you need it.
THE COMMON SITUATION
A custom site built years ago, code only on the server, nobody with a local copy. One accidental deletion from losing it entirely.
