Drupal Security Best Practices

1. Update drupal core and contrib odules to the last version

Example with composer if you use core-recommended:

composer update  drupal/core-recommended:9.3.14 -W

2. Perform Regular Backups of the files and database.

You can use Backup and Migrate module

3. Avoid simple username and passwords

Avoid admin, root, drupal, 1234 ...

4. Block access to important files and unwanted text files using .htaccess file..

RedirectMatch 403 "/core/(.*).php"

RedirectMatch 403 "/core/(.*).txt"

RedirectMatch 403 "INSTALL.txt"

Or

<FilesMatch "(authorize|cron|install|upgrade)\.php">

    Order deny, allow

    deny from all

    Allow from 127.0.0.1

</FilesMatch>

5. Block bad bots using .htacces file.

RewriteEngine On

RewriteCond %{HTTP_USER_AGENT} ^.*(agent1|Wget|Catall Spider).*$ [NC]

RewriteRule .* - [F,L]

6. Enable trusted host from settings.php file.

$settings['trusted_host_patterns'] = ['^www\.example\.com$',];

7. Always use secure connections

8. Check file permissions