A shop is the one kind of site where a backup gap costs you real money, because orders arrive continuously and cannot be recreated.
What has to be in it
Both the files and the database. The database holds every order, every customer and every setting. A file backup on its own restores a shop with no orders in it, and people discover this at the worst possible moment.
How often
More often than a normal website. If you take orders daily, a daily backup means at worst you lose a day of orders – which is still bad. Many shops keep the database backed up more frequently than the files, which is sensible: the files rarely change, the database changes with every order.
Where to keep it
Somewhere other than the hosting account. A backup sitting in your public_html does not survive the account being compromised, and it counts toward your disk and inode usage besides.
Before any change
Always take one before updating WooCommerce, updating a payment plugin, changing theme, or making a bulk price or stock change. These are the moments things break.
Test the restore
An untested backup is a hope. At least once, restore it to a staging site and place a test order. Discovering that the backup is incomplete is something you want to do on a Tuesday afternoon, not during an outage.
Watch the timing
A full backup of a large shop is heavy. Schedule it for your quietest hour, and never during a sale.
