1. Escape all output
echo htmlspecialchars($str, ENT_QUOTES, 'UTF-8');
2. CSRF tokens on forms
<input type="hidden" name="csrf" value="<?= csrf_token() ?>">
3. Honeypot against bots
<input type="text" name="website" tabindex="-1" autocomplete="off" style="position:absolute;left:-9999px">
Bots fill it, humans never see it.
4. Lock down uploads
# shop/uploads/.htaccess
php_flag engine off
Options -ExecCGI
Security is a habit, not a feature.