So I'm new to deploying apps to production, I'm curious of everything I need to do to make a website secure. As of now, I only know to setup SSL, I imagine there is more beyond that.
SSL doesn't have much to do with securing your website. If you are worrying about security, I would recommend to try to find solutions to solve the:<p>-integrity
-availability and
-confidentiality<p>Of your server and app. For integrity, look for file integrity monitors (OSSEC is a good open source project that does that).<p>For availability: load balancers, ddos protection, auto scaling are all things to look for. Products like CloudFlare and Sucuri can do it in the cloud for you automatically.<p>For confidentiality, try isolating your server, setting up firewalls to deny all by default, restricting access, keeping it updated, etc.<p>thanks,
<a href="http://guides.rubyonrails.org/security.html" rel="nofollow">http://guides.rubyonrails.org/security.html</a> is a good introduction for webapps written in Ruby/Rails and their countermeasures.<p>It's better to ask the same question on a <insert your programming language> forum or StackOverflow as most frameworks have countermeasures or configuration options included (salting password, inspecting HTTP headers, preventing SQL injection).
lockdown all ports except 22, 80, and 443 with iptables.<p>setup a fail2ban to update iptable rules to detect repeated hack attempts and ban their ip address.