Backups are your first defense against any WordPress attack. Remember, nothing is 100% secure. If government websites can be hacked, then so can yours.
It is important to regularly save full-site backups to a remote location (not the hosting account).
Based on how frequently you update your website, the ideal setting might be either once a day or real-time backups. The type of website also helps determine how frequently the backups occur.
i.e. E-Commerce sites should use Real-Time backups.
WordPress updates are crucial for the security and stability of your site. Therefor we need to make sure that your WordPress core, Theme and Plugins are up to date.