You should add that :

• No passwords should be their user names ( That is just stupid but happens).

• No actual words, or at least a word combination that is not in dictionaries ( I learned from a website about cyberspace problems and one of them was about problems. It said that sometimes hackers attack and hack with computers that could find words and then predict your password like that).

• Passwords should also be complex, unique but easy to remember like a sentence with the beginning of each letter somehow changed.

• You could completely not let people finish their sign up process unless they put at least some numbers and a capital letter with some other things, like H3110!:|.

• you could also add a checker to see lets them see their password's strength

• Try adding in 2nd and 3rd passwords with their phone number and other personal things like their thumb print ( this is inspired by Google  ) so that way the hacker has to litterly "be" their victim in order to get past.

• Try encrypting their information with another password that just the person knows in case of an hacker ever successfully hacked in, so they can't get through this password either very easily.

• I know this one is going to be hard to add but maybe add an little companion on your website/place/whatever that knows their personality so if it sees a change, it would probaly guess it would be a hacker unless the person said so in the first place. Kinda like a personality software for every user ( everyone is different after all  ).

-Also alert them if anyone else besides who they know goes on to their account. If they say they don't know who that person is it is probaly a hacker then ( Google does this ).

• For phishing mails/things/whatever try scanning them first before letting them see it ( test if it's safe), them ask them about it, and if they say no, destroy it, preventing them to be tricked by the hacker.

You should add that:

• No passwords should be their user names (that is just stupid but happens).

• No actual words, or at least a word combination that is not in dictionaries (I learned from a website about cyberspace problems and one of them was about problems. It said that sometimes hackers attack and hack with computers that could find words and then predict your password like that).

• Passwords should also be complex, unique but easy to remember like a sentence with the beginning of each letter somehow changed.

• You could completely not let people finish their sign up process unless they put at least some numbers and a capital letter with some other things, like H3110!:|.

• you could also add a checker to see lets them see their password's strength

• Try adding in 2nd and 3rd passwords with their phone number and other personal things like their thumb print (this is inspired by Google) so that way the hacker has to literally "be" their victim in order to get past.

• Try encrypting their information with another password that just the person knows in case of an hacker ever successfully hacked in, so they can't get through this password either very easily.

• I know this one is going to be hard to add but maybe add an little companion on your website/place/whatever that knows their personality so if it sees a change, it would probably guess it would be a hacker unless the person said so in the first place. Kinda like a personality software for every user (everyone is different after all).

• Also alert them if anyone else besides who they know goes on to their account. If they say they don't know who that person is it is probably a hacker then (Google does this).

• For phishing mails/things/whatever try scanning them first before letting them see it (test if it's safe), them ask them about it, and if they say no, destroy it, preventing them to be tricked by the hacker.