Determine the composition and allowable losses
Keep code, uploaded files, the database and required configurations with limited access to secrets. Agree on acceptable data loss over time and desired recovery period. For a store, a daily backup may not meet the acceptable loss limit for new orders. Copies are required separately from the primary environment and with a validated retention policy.
Continue with: WordPress updates: backups, staging and functional checks.
Restore the isolated copy
Use a separate directory or server, close access and disable real payments, emails, advertising and CRM operations. Check database import, image files, domain settings and access rights. Measure the actual recovery time and capture the dependencies you need.
Continue with: Website migrations: redirects and post-launch checks.
Check the useful result
Open important pages, log in as a test user and go through agreed business scenarios. Reconcile control records and dates. To return to production, you need a plan of new data created after the backup. An old database cannot simply overwrite the current one without assessing the losses.
Is hosting provider backup enough?
This is a useful level of protection, but you need to know its composition, terms, access and recovery procedure. A restore test is still necessary.