Secure HTTPS sessions, rate limiting and optional authenticator-based 2FA.