Is it running on a dedicated machine? Than what's the worst that could happen? Say someone hacks your website and gains root access to your machine. Maybe they'll fuck up your website. Maybe they'll install some botnet software. But you can basically just flash your device and restart from a backup. No biggie!

The best defence, in my opinion, is awareness and a good backup plan.

But also, if you have a static website with no login or anything, a hacker can't login either. Maybe you've got an ssh connection? That's pretty secure, just make sure you've got it set up correctly and you've got a good password. Maybe you have some login from apache? Same as with the ssh, but if you don't actively use it, you could disable it.