Sorry to hear about the hack. That sucks.
- Minimize amount of plugins
- Have a strong password that you change every 2-3 months
- Don't use a login username that is generic, for example "admin"
- Don't use cracked themes or plugins
- Keep theme and plugins up-to-date
- Use Wordfence, with their login security activated so that you need your phone to sign-in
- Avoid unknown themes. Use something like Generatepress, Blocksy or similar frameworks instead of Themeforest themes
- Use Cloudways VPS
- Don't share your log-in details to anyone
These are the things I come to think of right now.