Use HTTPS and a strong admin password. Copy config.local.example.php to config.local.php for production DB settings.