HyNrgy :
Well, this is my setup, maybe overkill but works for me and do not see any system drain (though i have a laptop with i7, etc)
Bitdifender total security (prefer detection rating and scores) always on in background
Malewarebytes run about once every two weeks to a month
Advance system care (due to adding known 100% bad sites to not allowed on computer...i use for other things but that is what is related to here)
Browswer I run
Ghostery
Adblocker
Https everywhere
Bitdefender trafic light
Definitely overkill, but do whatever makes you think is necessary. If I run either Iron or Aviator, the only security add-ons I have personally added are AdGuard, No History, and IBA Opt-Out. Aviator does come with built-in Disconnect searches, which offers extra privacy of your searches, though no other security measures. I have cookies set to clear after every time I close the browser, and I also have Java disabled and completely removed from my computer. Unless you really need to run Java, get rid of it... it's just a vulnerability.
HTTPS will only provide some protection, as there are legitimate companies that are hired to provide HTTPS interception. Seriously, there are companies who provide man-in-the-middle (MITM) 'attacks' for HTTPS browsing, and sell the activities to whoever asks for it. It's a nice idea to prevent small time hackers; just know that it's still a vulnerability, regardless of common belief. HTTPS is fairly easy to spoof on your own, too (if you care to do it)... so just putting that out there.
HyNrgy :
The best protection is BACKUPS. I use macrium reflect free and backup every two weeks (just my preference) and keep the past 4 incase I something happens because no program paid or free is 100% solid on all fronts....if there was one there would be only one answer here..
Backing up information is only going to be as clean as the computer you plug it into. If you plug in your backups while infected, you risk re-infecting your PC every time you plug it back in. Scan your backup data as often as your computer. If it's in the cloud, then you're kind of SOL with that idea. Be sure to scan everything, and then encrypt it when you upload it to the cloud server. That will ensure it will be identical to when you uploaded it, and it's also safe from prying eyes at the same time. Also, there is always the risk of your cloud host being infected (rare, but a possibility), so never think your cloud backups are completely safe.