Assuming the site has been configured properly to begin with ensure security advisories are read, security patches are applied and security related upgrades carried out. Refuse to trust security through obfuscation. If a software vendor won't discuss the security issues you raise don't use it. Security works best if it's been peer reviewed. Concealing problems benefits crackers, not clients.
Process log files.
Logs are your greatest security aid. OK, they're large, but processing data is exactly what you bought computers to do. Once you know what you're looking for it's relatively easy to set up scripts to process logs and email an administrator if anything is amiss. It costs money to do this, but it costs more to recover from a total loss of customer confidence. Deskilled Server Administrators Windows NT servers can be made pretty secure, but the point and click approach to configuration has led to server administrators with less well developed skill sets than in the past.