What do I do first, if I want to improve my security?
Answer first
Protect your email. Many other services use it for password recovery, so start with a unique password and two-factor authentication there.
Start with email. It can often reset passwords for other services, so losing the account can lead to the loss of several others.
The second step is to stop recycling the same password. A password manager does the remembering, and your browser already has one built in.
The third step is the router. Updates on, remote management off, and the admin password changed if it is still the one the factory set.
The fourth step is separation. Smart devices get a network of their own, so that one device’s problem is not the whole home’s problem.
These four changes use the devices and services you already have and need no new security subscription.