Best thing you can do is this:
- ask your registrar to do the 'registry lock' on your domain. Not registrar lock but 'registry lock' specifically. Most will do this. If they won't, then transfer to another registrar.
- register the domain for at least 5 years. 10 years if you can.
- use the 2FA at your domain registrar. There are some registrars that offer a "pass code" or other task to be performed before the domain can be transferred. At one registrar, I have the requirement that they need to call me on my cell phone and I must mention a code word to them.
- If you're using Google or a Google Account (not recommended but in some cases it's necessary), then absolutely sign up for Google Advanced Protection. I cannot tell you how many domains have been stolen and lost because they were using a google account (gmail).
- Remove privacy whois on your domain. Use a business address, email (not gmail) and a real phone number on the whois of your domain. If the domain is stolen, then the whois history will show who owns it... if it goes to privacy then the thief/hacker most likely wants to hide themselves. If you get spam email/calls from that public whois data, then change registrars. It's certain registrars that are giving out or allowing scraping of their whois data.
- If you don't already own a trademark on the word in the domain, then don't think that that getting a tm will protect your domain name. If you registered the domain before someone files for the trademark, then you have the rights to it. Don't let anyone else tell you that you don't, especially if you are using it for a website.