Use wordpress - how?

Depends what you mean by use it - building a site, or looking after one somebody handed you? If it's the second: take a backup, then Dashboard > Updates and bring core, plugins and theme up to date. Then go through Users and delete any admin account nobody can explain. That alone heads off most of the hacked-site stories.

child theme before you touch anything. every "my changes vanished" post i have ever read is someone who edited the theme files directly and then hit update. after that it is mostly restraint - fewer plugins, decide your permalink structure on day one and never change it without redirects, and keep a staging copy so you are not testing on the live site. and backups you have actually restored once, not just scheduled.