Picked up most of these the hard way after a couple of bad nights, so figured I'd share in case it saves someone else the same headache.
- Automate backups AND actually test restoring them. A backup you've never restored isn't a real backup, it's a hope. Schedule a test restore every once in a while, even to a throwaway VPS.
- Set up basic uptime + resource alerts. Something as simple as a free uptime monitor plus alerts on disk/RAM/CPU thresholds means you find out about a problem from an email, not from angry users.
- Keep the control panel and OS patched on a schedule. Not necessarily bleeding edge, but don't let security updates pile up for months either - that's usually how boxes get compromised.
- Harden SSH early. Key-based auth only, disable root login, and something like fail2ban goes a long way against the constant background noise of bots hammering port 22.
- Write down your own stack. A simple doc of "here's what's installed, here's where the configs live, here's how to redeploy this" saves a ton of stress when something breaks and you're troubleshooting half-asleep.