It's not hard, you won't get breathless! ;-)
By the configuration stage, the mental tax can often be as low as checking off items on a checklist.
It is a whole different skill set though and it's trickier in some ways e.g. a developer can often depend on his compiler to tell him if he's messed up the basics.
You could go-live with a host having most attack surfaces battened down tighter than a crab's harris at 50 fathoms, but because nothing told you about DNS tunnelling... (feel free to insert A.N. other rarely talked about but trivial attack)
>> Are directories only writeable by the web server user?
The web server user shouldn't be able to write anywhere except perhaps an upload directory inside its chroot. At no point should it be serving files from that dir (a common mistake).
With tools like SELinux around you can often help cover yourself from midnight mistakes down the line.
A blisteringly common one not mentioned is database authentication details inside .pl, .py or .php scripts.
>> Is PHP installed on your Python server?
Another common one is GCC installed. Often when building perl / python / ruby / nodejs modules or whatever, these will be built on the prod server in small shops. That often means a full compiler suite laying around.