The best password habit is using a different password for every important account. Reuse is dangerous because one leaked password can unlock many services.
Use a password manager so your passwords can be long, random, and forgettable. A password you never need to memorize is usually stronger than one built from a pattern.
Enable two-factor authentication for hosting, email, domain registrar, CMS admin accounts, and payment services. These accounts can control your website even if they are not part of the site code.
Avoid sending passwords through chat or email. If access must be shared, create a separate account with the minimum permission needed and remove it when the work is done.