On a Linux-based server, I follow basic practices as below:
- Make the admin account password long and complicated enough (i.e. theoretically speaking, password cannot be cracked within reasonable time).
- Monitor all incoming network traffic to the administrative files.
- To extend the layer of protection from #2 above, monitor local file changes (especially ones that have commands that require sudo privileges).
- Validate all user input, so that all of the user input is guaranteed to be safe.
As a novice developer, I don't understand how a hacking is even feasible if the server admin practices the above.