I created a ecommerce site with a developer. He completed almost all his work but in the end we had some financial disagreements so our partnership ended in a bitter dispute. That developer threatened to hack my site using a backdoor. To cut long story short, that guy was able to buy products from site without even paying. He bypassed payment processor and bought products. Thankfully i didnt shipped any products to him. Btw i want to clear that i had installed mod security firewall and my server was fairly secure. I hired another developer and he did full code review and found hidden admin account. He told me that my site can be hacked again as he may have left some other backdoors.
So my question is, Are there any good practices that can be used to reduce backdoor damages/hacks. The question is not too broad. I want to know basic security practices to protect ourselves from these kind of hacks?