Bad news, you can't do much!
You can never trust a user, their input, or anything else about them. The most you can trust is they are using your service. Even then you can't always trust that they aren't being impersonated.
For site security there is the gamut of usual suspects(Use SSL and make sure you get a good grade on ssllabs, sanitize input, secure SSH access and admin access to specific static IPs, so forth and onward to infinity and beyond, too broad of a question to answer here), however increasing a user's security on their end is impossible. You can't force a user to do anything, so the best you can do is make your site and database as secure as possible.
Really the most you can do for a user is enforce strong passwords. Even then they might try to get around it.