A practical starting point
Update WordPress, themes and plugins from trusted sources. Use unique passwords and appropriate permissions, and keep independent backups with a tested restore process.
Test before you change
Record the current setup, make one change at a time and compare the result. Ask your provider about settings specific to your hosting plan.