How can I keep a PHP website secure?

The answer

Validate all input on the server, use prepared statements for every database query, hash passwords with the built-in password_hash function, and escape output with htmlspecialchars to prevent XSS. Add a token to forms against CSRF, secure your sessions, use HTTPS and hide detailed errors from visitors while logging them. Keep PHP, frameworks and plugins updated, and give each part of the system only the access it needs. See the guide PHP Security Basics.