4096 bit RSA key is overkill and slow. 2048 is fine for years

You probably need to support TLS 1.1 for some older clients

Password entropy checks should only be used in a corporate environment. You'll lose customers in a retail environment. You should certainly encourage your customers to use high entropy passwords, but forcing them to will just lose you money.

Login throttling and IP banning is a waste of time. Login throttling will just DoS yourself. You need CAPTCHA or Proof of Work.

Synchronizing Token (CSRF token in hidden form fields) is better than CSRF cookies

Use a real HTML parser (*Soup) to invalidate XSS form input not regex