This unit is short and practical: each page ends in things to check, not principles. The platform does part of the work: it checks the CSRF token on signed-in writes, stores passwords hashed, and offers reCAPTCHA on registration, checkout and forms. The rest is decided per site: the limits in front of the sign-in forms, the minimum password length, and what your templates, emails and jobs print or log.
CSRF on member forms covers where the token comes from and the one legitimate exception. Rate limiting and captcha covers what to put in front of sign-in, registration and password reset, and where a captcha helps. Personal data in logs, emails and the browser is the page that prevents real incidents. The pre-launch checklist collects all of it, with the settings from the rest of the guide, on one screen for the week before launch.