I'm having issues loading your XML [product] sitemaps in my Google Chrome browser. If search engines are choking on the sitemaps, it's probably not helping. It might be worth it to split from two to 3 or 4. Also, I noticed that your Robots file mentions Product and Category sitemaps, but not a general sitemap for CMS pages. I'm not sure if they're mixed into one of the other sitemaps, but I thought it would be worth mentioning.
https://testmysite.thinkwithgoogle.com/ is seeing an 11 second loading time on 3g, which is in the red as far as Google is concerned. << Snipped >> On the hosting side, you may be able to take steps like using gzip or deploying and configuring a CDN like Cloudflare to help.
I haven't noticed a specific security issue that you would be penalized for (although I can't completely rule it out), but I did notice that:
- Your hosting server is running an outdated version of Nginx
- Your /admin and /downloader pages are available to the public
- You're not using 2-Factor authentication to ward off brute force attacks
For a more thorough free security assessment, I'd recommend: https://jetrails.com/security/
In other news, you're using some deprecated HTML Tags (<center>)
However, I'm not finding a smoking gun.
As I wouldn't know otherwise from the outside, I'm assuming that Google & Bing Webmaster Tools (Search Console) aren't telling you anything helpful, neither are your Magento error logs, that you haven't made any major changes to the site or to your URLs, and that your hosting environment is stable.
My other recommendation is to track your backlinks using a tool like https://analytics.moz.com/pro/link-explorer/home to watch for "spammy" backlinks which can be toxic to your rankings, and "lost" backlinks that may be negatively impacting your rankings.
Lastly, there's always focusing on positive SEO, like additional healthy backlinking, new content, rich snippets, getting more customer reviews to add to your content, etc. etc.
Best of luck!
