Server-side security cannot protect you from malware on your own machine. If your laptop is infected, an attacker sees every password you type.
THE BASICS
Keep your operating system and browser updated. Install updates rather than deferring them indefinitely. Run reputable antivirus and keep it current. Do not install cracked software. Cracked design tools and office suites are a common malware source, exactly as nulled plugins are on the web side. Be cautious with browser extensions. Many request permission to read everything you type.
FTP CLIENTS ARE A COMMON TARGET
FileZilla and similar tools store saved site passwords in a file on your computer, and several malware families specifically look for it. If your sites are defaced repeatedly with no server-side explanation, this is often why.
Use a master password in FileZilla, or do not save passwords at all.
PUBLIC AND SHARED COMPUTERS
Never log in to cPanel or your Client Area from a cybercafe or a shared machine. If you must, change your password from a trusted device immediately afterwards.
PHONES
Keep the phone holding your 2FA app locked with a PIN or biometric, and keep its software updated.
