Take one before every update, migration or significant change. It takes two minutes and has saved a great many sites.
FULL ACCOUNT BACKUP
cPanel > Backup > Download a Full Account Backup > Home Directory > Generate. You are emailed when it is ready; return and download it. Delete the archive from the server afterwards so it does not fill your quota.
This includes files, databases, email and settings.
PARTIAL BACKUPS
The same page offers separate downloads for the home directory and individual databases. These can be restored by you from the same page, which makes them more practical day to day.
APPLICATION PLUGINS
UpdraftPlus and similar tools can back up on a schedule and send the archive to Google Drive or Dropbox automatically. Configure remote storage; a backup left on the server is lost in the same event that loses the site.
Note that scheduled backups depend on cron. On our servers, WordPress needs a real cron job because HTTP wp-cron is blocked, or the schedule will never run.
RETENTION
Keep several recent copies and at least one monthly. Infections often go unnoticed for weeks, and three days of backups may all be infected.
