A2 Hosting Windows outage slips into May and ‘restore’ was the hardest word for them. This can happen to ANYTHING on the internet. Never trust a backup that you don’t have in your possession. Once again, Ours wise words are proved right: DON’T TRUST YOUR HOST’S BACKUP.
Having your own backup is so cheap too. Less than a cup of Starbucks coffee. You can either use a plugin and drop it offsite or just use Managed WP, VaultPress etc.
Just for info purposes here is what WordPress writes on backing up your WP site. Essentially you need to make a copy of all the files from root that are part of WordPress and you need to export a copy of the database, these two parts are enough to restore your site manually.
Generally though using a backup plugin, which includes a restore component is generally preferred, as it runs scripts to change things like database username and passwords, (importation of the db to the new location) addition of new users (admins) to the database, etc. You can use paid solutions like IThemes BackupBuddy, or WPMUDEVS Snapshot, and moving plugins like Duplicator, but I’ve recently started using again the free version of.
For securing WordPress website, You can rely on really stringent server hosting rules, with ModSecurity, and also use 2FA And use the 6G firewall rules.
Never rely on any hosting service for website backups. If site backups are included as part of your hosting plan, that’s great. But you still need to use an outside backup service.