Hello, @johnallen12345

This is a really interesting question and the answer for this is definitely not short. A lot of things can be be done in order to protect your website and I will try to mention the ones that are most important.

You can start with your server and make sure it’s secure and not running any outdated and vulnerable software. You need to update your packages frequently (if your application/website does not require specific version of certain package).

I will recommend you to check this two articles for securing your Linux server:

https://www.digitalocean.com/community/tutorials/an-introduction-to-securing-your-linux-vps

https://www.digitalocean.com/community/tutorials/7-security-measures-to-protect-your-servers

It’s essential to make sure your server is secure and then you can further tweak the configuration to protect your website from attacks. You can make sure all of your passwords are secure and use ssh key based authentication to your server.

When it comes to website security there a important things you need to follow. You can make sure that you do not have any directories or files with 777 permissions because this can be used to exploit your website. The folder and file permissions can be different because some website’s CMSs or frameworks may require different permissions, but having 755 for your directories and 644 for the files will be good enough.

You can also disable the website’s directory browsing as this will protect you from people looking at what you’ve uploaded to your droplet. It also comes handy to protect your private data (non website’s files like backup files and etc) from being crawled from search engines.

If your website is using any additional software like plugins, modules and etc make sure that they’re always updated, because updates often include security patches.

Depending from your web server you can secure the admin area of your website with password protection or keep it available for a certain IP addresses.

Hope this helps

Regards,
Alex