For a site that is commercial and not just a fun thing I think you should always be monitoring the basics and watching the trends which they produce. So CPU, Memory, I/O, Non 2XX HTTP responses, server logs, nginx/apache logs, # of sessions, traffic by hour and traffic by day. If you are running a wordpress site or similar I'd also be putting watchers on new file creation & updates on the upload directory and the themes. This just helps you see if there is any activity happening you didn't trigger or expect.

Any outbound calls your site makes to 3rd party services should be logged and reported on, set up triggers and alerts for non 2XX codes again. You want to know if something breaks before you have support requests coming in.

SSL certs have already been mentioned by watching those and setting up reminders for renewals is important, same with any plug-ins or other licenses you need to renew on a recurring basis.

This at least covers all the basics IMO. Obviously some of what I mentioned can be done from proper monitoring of the log files, like non 200 responses, traffic, sessions etc. Also, don't reinvent the wheel, plenty of tools in open source that can help you do all this with just some setup and configuration.