Security Intro
What to back up: code, database and uploads are not alike
Manage it as one lump called "the full backup" and an incident leaves you no options. The three parts change at different rates and restore along different paths.
Technote
A backup you have never restored is not a backup
Having a backup and being able to restore are different things. Turning restoration into a drill, and designing for a shorter recovery time.
2 articles
Security Intro
Work backup frequency backwards from what you can lose
"Once a night" is a convention, not a reason. Frequency falls out of how much work you would have to redo — worked backwards.