Store passwords with Argon2id, offer passkeys as the strongest sign-in option, separate a user's identity from their account record, and rate-limit every authentication endpoint. Do not impose composition rules or forced password changes, as NIST advises against both. The weakest part of most systems is not the login screen but account recovery, so treat the reset flow with the same rigour as sign-in.
The five practices that protect most websites are multi-factor authentication on every administrative account, prompt patching of your CMS and plugins, HTTPS with automatically renewing certificates, parameterized queries and input validation, and backups stored off-server that you have actually restored. One widely repeated piece of advice is now wrong: NIST no longer recommends forcing regular password changes, because it produces weaker passwords. Change a password when there is evidence of compromise, not on a calendar.
