Make sure your router doesn't allow admin access from the outside. Make sure you have a decent admin password. Disable any built-in cloud/ftp/sharing services that you don't use or need. If you use them, make sure to use good passwords and remove any built-in/default account. Disable UPnP in the router if you don't really need it (and understand the risks).

I'm no expert but I imagine it's a combination of keeping your router's firmware up-to-date, using a properly configured firewall, and using a strong password for your router login.

You'd think, but most consumer equipment is abandonware and the firmware isn't updated once a newer model is out.

don't let your router be able to be accessed from outside, ie disable 80/8080/22.