Short answer
A website backup should cover the files and the database, be stored off the server and be made regularly: weekly for most websites, daily for those that change often. Without a backup, an attack or error means rebuilding the site from scratch.
Why is a backup not optional?
Attacks happen every day, to small websites too. A system or plugin update can break the site, and a server error can erase data. Without a backup you start from zero. Maintenance includes regular backups.
How often should you back up?
Weekly for most websites, daily for shops and booking sites. The copy should be stored off the server in case the server fails. Keep at least the last four weekly copies.
What should be saved?
The whole website: files and database. Images, documents and uploads. Settings. And email, if it runs on the same hosting. Automatic backups are part of maintenance.