On my and my families windows machines, I try to follow the advice from Taylor Swift who seems to know what she is doing... https://decentsecurity.com/#/securing-your-computer/

In short: 1) secure bootup by locking up BIOS and encrypting your drive 2) set User Access Controls to the highest level 3) install up to date browser with appropriate addons (ublock)