Yes, making a secure site is a big topic. It depends on your OS type, network usage and so on...
Let me give you some suggestions, suppose you are running Windows.
1. Use SSL(HTTPS) for the remote administration connection, use FTPS/SFTP/HTTPS for the client connection.
2. Add a IP Access mask for remote administrator.
3. Open server listener as few as possible, if you want secure FTP, so just open FTP/FTPS ports, do not open SFTP port.
4. Enable "Anti-Hammer" option, set it like this "Ban IP 1000 seconds if 5 failed login tries in 120 seconds"