I want to secure site which is locally used for Prepaid Services, the site has been hacked many times, for the first step, I implemented SSL and its now working fine, however, I want to be sure that attacker can't get user data in transit because many users connecting to the site from restaurants or public places.
One scenario: Using BackTrack attacker can redirect all HTTP traffic to single IP and show fake page to user, I knew browser shows SSL error, the best way to prevent this attack is to educate user, however, I want to ensure that there is no other way that attacker can attack the site anymore.
Update: I planned also to implement PIN verification (Sending random PIN by SMS for extra verification)