There is so much out there about securing your websites, update everything, patch everything, latest everything, and then there are the settings in the web server itself.

Clearly, keeping everything patched is a must, but these web server settings are key.

I think one of the best checkers I have come across so far is https://observatory.mozilla.org/ It will link off to several other third party checkers, and has really great documentation to explain what areas you could improve. https://infosec.mozilla.org/guidelines/web_security

Part 2 – what settings are a good idea.