On a VPS, backups are entirely your responsibility unless you have bought them.
WHAT TO BACK UP
Application files Databases, dumped rather than copied live Configuration files, including web server, PHP, mail and firewall SSL certificates and keys, if manually installed Cron jobs User accounts and SSH keys Mail, if the server handles it
WHERE TO STORE IT
Off the server. A backup on the same machine is lost in the same event that loses the machine.
Remote storage, another provider, or your own infrastructure.
HOW OFTEN
Databases daily at minimum, more often for transactional systems Files weekly, or after changes Configuration whenever it changes
RETENTION
Several recent copies and at least one monthly. A compromise discovered weeks later needs a backup predating it.
THE TYPES
Snapshots capture the whole machine and restore quickly, but are usually stored by the provider rather than independently. File-level backups are portable and restorable anywhere.
Use both if you can.
TESTING
An untested backup is an assumption. Restore one periodically.
