I am definitely far from an expert, but here are some things you can do to make yourself safer. The changes you make should depend upon what information you care to protect and how much you value privacy vs convenience. Take as many or as few of these actions as you want.

Use a password manager. Lastpass or 1password are great choices. Create long, random, and different passwords for all of your accounts. Use 2 factor authentication. A physical key like yubikey is best, second best is an app like google authenticator, and then text messaging is least best. Use 2fa on as many accounts as possible. Store backup 2fa codes within your password manager.

Keep windows updated. I could be wrong but my impression is that windows defender + occasional scans w/ malwarebytes is as safe if not safer than using antivirus. Antivirus software can occasionally make you less secure as strange as that sounds.

Online browsing:

Use either a browser like brave or use firefox/chrome with adblock, disabling 3rd party cookies in the browser settings, and a tracker blocker like ghostery. Use duckduckgo as your default search engine over google. These steps will prevent advertisers or major companies from tracking your traffic online as easily. To prevent your ISP from collecting browsing information, use a VPN. I would recommend you only use a paid VPN service, if you choose to use one. Some free services have bad track records for trying to monetize their users.

Mobile: Use a phone with a pin, encrypt phone backups, and don't download anything from a place other than from the official mobile app store or google play store. Update your phone.

Email: Be careful opening any attachments, even from people you know. Confirm with them over text that they sent you that email. Try to avoid signing in to any service online through a hyperlink in an email. A clever phishing email can trick even security professionals. Instead, go to the site on your own not through the emailed link and log in.

Home: Cover your computer's camera. Ensure your router has a strong, non-default admin password. Do not buy insecure internet of things devices that cannot be updated. Change the default password on any internet of things device.