You should back up your site's MySQL database and all files in your site's web folder. Also, include any protected files stored outside your web root folder or on third-party services.