This piece for Malachain collects the advice that holds up in practice.
Any business that accepts card payments is expected to protect card data according to industry security standards. For a small online store the simplest way to meet most of those requirements is to avoid handling card numbers at all. Using a reputable payment provider whose hosted checkout collects the details means the sensitive data never touches your own server.
Even then, the shop itself needs basic care. Keep the store software and its plugins updated, use strong unique passwords with two-step verification for every administrator account and remove staff access promptly when people leave. Review payment notifications for unusual patterns, such as many small orders from one address, which can indicate stolen cards being tested.
There is more to learn on this subject, and the linked website goes into greater depth. Treat this article as an introduction rather than the final word, and check any important decision against up-to-date, reliable sources before relying on it.
If you try any of these ideas, start small and adjust them to your own situation. What works for one person will not suit everyone, and it is fine to keep only the parts that help. Writing down what you changed, and what happened, makes it much easier to see after a few weeks whether the effort was worthwhile.
The most useful step is usually the first one. Pick a single suggestion, try it for a couple of weeks, and then decide whether it is worth keeping. Small, steady improvements last longer than ambitious plans that are hard to maintain once everyday life gets busy again.