crap coding aside, I find that a really strict ruleset on a kernel-level firewall (pf my preference) using FreeBSD's daily security run output to immediately patch any server vulnerabilities on my installed software makes my servers quite adequately secure. Of course, I backup to be on the safe side.
Extra layers of security can be added by hosts.allow with tcpwrappers enabled and a little used but darn powerful daemon is
DenyHosts to stop dead any brute force attempts