Install only plugins and themes that you trust and still need. Review the publisher, update history and compatibility before installing an extension.
Keep the core application, themes and plugins updated. Before updating, create a backup and confirm that you can restore it. If an update causes an error, disable the latest extension and restore the previous working copy.
Use a separate administrator account for daily work, enable two-factor authentication where available and never share administrator passwords in a support ticket.