These solve two different problems
Malware protection actively watches your live website for infections, vulnerabilities and suspicious changes, and removes threats when found. Website backup takes regular snapshots of your files and database so you can restore your entire site to a working state if something goes badly wrong — whether that is malware, a bad plugin update, or your own mistake. One prevents and catches problems; the other is your safety net if something still gets through.
What malware protection actually does
A malware protection service like SiteLock scans your website on a schedule (typically daily), checking files and database content against known malware signatures, flagging suspicious code injections, and monitoring whether your domain has been blacklisted by search engines or browsers for hosting malicious content. Higher-tier plans add automatic removal (fixing the infection without you doing anything manually) and a web application firewall that blocks malicious traffic before it ever reaches your site.
What website backup actually does
A backup service automatically saves copies of your website's files and database on a schedule (typically daily), storing them securely off your live server. If your site is compromised, accidentally broken by an update, or you simply need to undo a change, you restore from a recent backup — usually with a one-click restore rather than a manual rebuild. Without a backup, "fixing" a badly broken site can mean rebuilding it from scratch.
Why relying only on your host's backup is risky
Many hosting plans include some form of backup, but it is often infrequent, shared across many customers on the same server, and not guaranteed for individual, on-demand restores — it exists for the host's own disaster recovery, not necessarily as a service designed around your specific recovery needs. An independent backup service gives you predictable, automated daily backups with a restore process you control directly.
Do you need both?
For any website that represents real business value — generates leads, processes orders, or is central to your brand — yes, both are worth having, because they cover different failure modes. Malware protection reduces the chance of a bad day happening at all. Backup guarantees that even on a genuinely bad day, you can be back online quickly rather than starting over.
If you have to prioritise one first on a tight budget, backup is generally the more foundational safety net, since it protects you against a broader range of problems — not just malware, but also human error, bad updates, and hosting issues.