As asked, the question has no single answer. Security is a continual process, and a tradeoff with speed, usability, friendliness, bandwidth, etc.
The 100% secure website is one without an internet connection. The 99% secure website is one on a continually patched server, offering only static content, and accepting no user-supplied input other than the base url and clicks on links.
If you want to accept user input and serve dynamic content, it becomes a complicated process involving, at minimum, awareness of your own vulnerabilities and threats, and protection against the OWASP Top 10 and similar lists.