A secure setup is a shared effort. The plugin does its half. These four things are yours, and each one is confirmed for you on the Status page.
Keep WordPress, your theme and your plugins up to date
Boring, and the single most effective thing on this list.
Almost every WordPress site that gets compromised is compromised through something that had a fix available and was not updated. Not through a clever new attack. Through an old one, on a site that never got round to it.
Turn on automatic updates for anything you can. Check the rest monthly.
Serve your site over HTTPS
Look at your address bar. It should say https and show a padlock.
Nearly every host gives this away free now. If yours does not, ask, and if they will not, change host.
Without it, Mollie will not process real payments anyway, so this one settles itself.
Turn on the API key lock if more than one person has admin access
Go to Mollie Payments, then API keys, and switch on Lock API keys to my account only.
A developer, an agency, an employee, a freelancer. They all have a legitimate reason to be in your admin. None of them has a reason to read the key that moves your money.
One warning, and it is a real one. If the account you lock the keys to is deleted or lost, nobody else can read or change those keys without direct database access. That is the entire point of the lock, and it is also a trap.
So lock them to your own permanent account. Never lock them to a temporary admin account you made for a project and intend to delete.
Check your WordPress security keys are not on the defaults
Your keys are encrypted using your WordPress security keys, which live in your wp-config.php file.
If those were never set, and are still sitting on the sample values, the encryption is weaker than it should be.
This is easy to check, and the Status page confirms it for you.
And if a key is ever exposed
Go to your Mollie dashboard and generate a new one. It takes a minute, and the old key immediately becomes worthless to whoever has it.
Then paste the new key into the plugin. That is the whole recovery.
Nobody enjoys doing this, but it is far better than not doing it, and it is why you should never email a key, paste it into a chat, or put it in a support ticket.