The last one isn't directly related, but it highlights how easy it is to mess up with a web server administration.
As there are several things, that can be done, before something bad happens, I'd like to have your suggestions in terms of good practices to limit backside effects of an attack and how to react in the sad case will happen.
It's not just a matter of securing the server and the code but also of auditing, logging and counter measures.