Unique passwords in a manager
Use a password manager so every account has a long, unique password. Reused passwords mean one breach elsewhere unlocks your site.
Two-factor everywhere
Turn on two-step verification for your website admin, hosting, domain registrar and email. An authenticator app or security key is stronger than text messages.
Personal accounts, not shared
Give each person their own login with only the access they need, and remove it the day they leave.
Do this today
Turn on two-step verification for your domain registrar and website admin.