If it is wordpress or any other CMS website, always update it to the latest version of CMS, themes, plugins.
Also, use the complex password for any login credentials to the hosting account/CMS dashboard.
Do not connect the server or hosting account or CMS dashboard from a virus affect computer/local machine.
If you have root access to the server, it should be better to run Maldet Realtime Monitoring.
Do not use nulled wordpress or other CMS themes or plugins, always use recommended themes and plugins.
Make sure file permissions are correct, Only allow execute permission for required files/folder
Make sure unusable ports are closed in the server if you have ssh root access to the server.
