The first question is not whether you have backups but whether you can restore one without losing anything that happened since it was taken. On a course or membership site that means new orders, enrollments and lesson progress, which a plain rollback can wipe out.
Read the guide on backup retention and restore options first to see what your host keeps and for how long, then the restore guide for your platform so you know the exact steps before you need them. If you run your own server, read the guide on backups versus snapshots to understand what each one captures.
Read the malware cleanup policy guide before an incident, since hosts differ in what they will clean up and what they leave to you. Then set up monitoring that checks logins and checkout rather than only the homepage, so problems are caught before students report them.