My philosophy about website security is that you should not increase it to the point where admin duties become annoying. For example entering a password every time I want to edit a file is annoying. As much as possible the security should be doing its job behind the scenes.
"But if anyone does not provide for his own, and especially for those of his household he has denied the faith and is worse than an unbeliever." 1 Timothy 5:8