Define the recovery target
Decide how much recent data loss is acceptable and how quickly service must return. These are often called RPO and RTO. Choose backup frequency, retention and recovery tooling to match those targets.
Keep a separate failure domain
Copies on the same server can help with an accidental edit but do little against host loss or a stolen administrative credential. Use an independent destination and credentials that a compromised application cannot use to delete every version.
Keep application data consistent
A running database may need its own backup tool or a coordinated snapshot process. Copying files while they are changing can produce an unusable result. Include the configuration and secrets needed to restore, protected appropriately.
Practice the restore
Recover a sample into a separate environment and check that the application actually works. Record the steps, time required and missing dependencies. Monitor backup age and failed jobs so a broken process does not remain unnoticed.