Unfortunately, your site can be hacked even if you follow the WordPress security best practices. If an attacker successfully compromises your site, having a backup will allow you to restore your site to a clean state.
Since WordPress doesn’t have a built-in backup tool, having a solid backup strategy is your disaster insurance.
Use industry’s best available licensed backup application that allows you to easily backup your whole website. Set up automated backup schedules so backups run every hour, day or week. Store you backup files in a secure, remote destination so you can access them if your website ever goes down.