Lukewalker18 You can use tools like https://github.com/FloeDesignTechnologies/phpcs-security-audit to check your code and refactor it.
Almost all attackers use the headers to find flaws in the code securing them with https://github.com/BePsvPT/secure-headers will decrease the chance to find flaws in the code.
This is kind of old but it still have the basics https://github.com/marcocesarato/PHP-AIO-Security.
I like to encrypt as much code and sensitive data as possible, https://github.com/paragonie/ciphersweet this is a good aproach to do it.
Use custom sql queries, like let say now you use mysqld change it to something like mysqlcustomquery, and obfuscate the php that contains sensitive data like the mysqlserver.php wich contains your database details, and obfuscating all the code make the attackers to go blind over sql queries. It is still possible to delete the mysqlserver.php and show the error code so you should desactivate php error reporting. In php.ini modify display_errors to OFF.
Allways use minimal code in the frontend and use a folder outside your web directory to store the backend files so even if the hacker manage to get access to the frontend they are limited to the public files and without knowing the database queries they can't dump the database.
Public in www/wwwroot/yourwebsite , Backend let say in the home directory of linux you can put that directory like ~/home/backend1.
Use CloudFlare or another CDN with a good dns management so your server ip is protected, i recommand using a IPv6 because IPv4 is reused now and you can get a IP that was attacked in the past or have a active attack over it.
And allways check your javascripts to be updated because some attacks use javascript to find holes in the system.
And in final i'm always against control panels on a production server that is my choice so is pretty personal.
