Website security works best as several controls that reinforce each other. Start with HTTPS, strong administrator authentication, restricted privileges and prompt software updates.
What to consider
Backups are essential because prevention can fail. Keep recovery copies separated from the primary environment, retain multiple restore points and periodically validate that restores actually work.
Monitoring and logging help detect changes early. Track uptime, authentication events, file changes where appropriate, and suspicious traffic. For public applications, consider DDoS mitigation and web application firewall controls based on risk.