When was the backup made?
Compare the backup date with the incident timeline. If the start of the problem is unclear, a file name alone is not enough to establish whether a version is suitable.
Are files and the database included?
A WordPress backup needs consideration of both files and the database; they contain different material. Ask the provider what is actually included. “We have a backup” does not establish completeness. See the WordPress backup documentation.
What newer data could be overwritten?
List orders, enquiries, articles or member records created after the backup. Discuss whether they need to be exported and preserved, and have the owner agree the recovery point.
Can it be tested first?
Ask whether an isolated environment is available before replacing the live site. That environment should also avoid sending real emails or triggering live transactions.
What will count as a completed recovery?
Prepare a check list of important pages, images, forms and login functions. Use it after restoration and preserve the original version for reference. Agree the scope and data-replacement risks before execution.