Password security really only consists of two things.
1. Ensure that your password can’t be easily guessed.
2. Keep your password secure so others can’t read it.
On the first of these.
You don’t have to go crazy on password length or complication. A 7 character password, if it includes a mixture of numbers and letters, will do just fine. IF it includes both lower and upper case letters. And IF it doesn’t include real words and obvious numbers (like your street address).
It would take millions of tries to guess a password like that.
Make sure others in your company AND your provider also practice proper security. You are not alone in the boat. If someone hacks the password of another email account in your company, or on the server you share, it can take the whole server down.
For the second, besides the obvious (don’t put your password on a post-it note on your screen), do not host your website on a Windows server. They are not and never will be secure.