Curious to know what steps people here are taking to protect their sites, products, and APIs. What have you tried that actually works in practice?