Start with the recovery you need
Ask two questions: how much recent work could you afford to lose, and how long could the application be unavailable? Those answers help you choose a backup frequency and a recovery process that fit the project.
Document what has to come back together: application files, databases, uploaded content, configuration and the secrets needed to operate. A copy of one directory may not recreate the whole service.
Keep an independent copy
A backup on the same VPS can be lost with the server or compromised through the same access. Keep copies outside that environment and review the permissions protecting them. Do not assume that a backup service is included unless your service agreement says so.
Use a method that suits the data
Databases change while applications run. Choose an application-consistent method supported by the database you use, rather than assuming a copy of its live files is sufficient. Read the version-specific instructions for creating and restoring the backup.
For PostgreSQL, the official documentation describes SQL dumps and the tools used to restore them. Choose the approach that matches your database version, size and recovery requirements.
Decide how long copies should exist
Balance recovery history, cost and data-retention obligations. Know when old copies expire, how deletions work and who can retrieve them. Backups containing personal information or credentials need appropriate protection throughout their lifetime.
Practise the restore
Restore into a separate, controlled environment. Confirm that the application starts, representative records are present and necessary files can be read. Check the actual time needed and record any manual steps.
Do not run an untested restore over your only working production copy. Keep the exercise isolated, particularly when restored data could trigger emails, payments or background tasks.
Make the result visible
Monitor failed backup jobs and periodically check successful ones. A completed upload does not by itself confirm that the data can be restored. Record who owns the process and when it was last tested.