What do you want to protect it from? If you don't allow user published content, you are not all that endangered. Use 2fa for the admin panel and the hosting inf

What do you want to protect it from? If you don't allow user published content, you are not all that endangered. Use 2fa for the admin panel and the hosting infrastructure behind. Check for the crm security updates. Check that you are using good and trusted cdn. Use https for the main site and the loaded resources. Keep login monitoring for the admin stuff. This will cover you for the most common attacks. If someone targets you specially, you are screwed anyways and there is no sense in wasting time and effort for something with diminishing returns.