Making a website secure is such a broad question it can't really be answered comprehensively in a question like that. A better starting point is "how do I protect my application from threat x"