Start from what you can afford to lose
- A site that changes little (a brochure site, a few pages): one backup a week, and one before every major change.
- A site that is busy every day (posts, comments, sign-ups): one backup a day.
- A site that takes orders or bookings: at least one a day. The day's orders are in the database; once lost, they can't be recreated.
Before every update
Many breakdowns happen just after a plugin, theme or WordPress update. A backup made just before lets you go back to how things were, without losing anything from the day. Automatic updates count too: they happen while you're not there.
Automatic, or it gets forgotten
A backup you have to remember to run ends up being forgotten. Schedule it at night, when the site is quiet.
Also check that it really runs. By default, WordPress scheduled tasks only run when a page of the site is requested: on a night with no visits, nothing runs, unless your host runs them itself.
How long to keep them
A problem doesn't always show straight away: a page deleted by mistake three weeks ago, a site quietly hacked. So also keep older backups, spaced further and further apart: every night for the last week, one a week for the last month, then one a month.
Keeping everything forever isn't a good idea either: storage costs money, and your backups contain your customers' data, which must not be kept indefinitely.