Use long unique passwords (or a password manager) for client area, SFTP, WordPress admin, and email. Never reuse the same password across systems.

Rotate credentials after staff leave or after a suspected compromise.