1) dont use xampp or preinstalled 1clicks just so u know what is and isnt installed
2) dont leave testing files like register.php or osds in a folder open to public (atleast .htpassword the dirs u have test php scripts)
3) sql inject protect any variable that goes into a query somewhere in your scripts (not only form fields but also cookie values and url get;s
4) restrict IP access to remote dekstop
5) read my performance guide on DKU
6) never run web-scripts as SA! create a new user in sql and only give it the rights it needs (u don't want to know how many servers still listen to the good old shutdown(); command)
7) create hourly incremental backups of the database or better yet (atleast i do) replicate all to a 2nd sql server
8) antivirusscan anything you want to run on your server using

installing antivirus on the dedi only slows things down
9) if u know any ask a friend with the knowledge of things to try and hack your server and report to you what he thinks isnt secure enough

10) before installing or using 3rd party utilities on your server go through their source first and look what it all does
11) once u got famillair with all the needed ports enable firewall and only open needed ports to the public (web / gameport / rdp)