Secure web hosting, 2FA, always keep WordPress cores / theme / plugin up to date. Don’t use simple password. Don’t use admin as username. Golden rules is never use nulled theme / plugin. Even some GPL site comes with malware.