OJS (and other PKP software) don’t automatically back themselves up on a regular basis – that’s not normally the job of a web application, it’s the job of the server administrator. You’ll have to ask your server admin whether they have a backup process in place.
There is a common misconfiguration of OJS that can make it vulnerable to attack – check to make sure your files_dir (configured in config.inc.php) isn’t web-accessible, either by moving it outside of your web root or by protecting it via a .htaccess file or similar mechanism. See PKP Applications and Security for details.
Regards,
Alec Smecher
Public Knowledge Project Team