Add password protected admin directory.
Add another SQL injection.
Add clickjacking page.