Built-in flood protection and a Server & Security page

Server & Security (under Settings) runs through a checklist of common misconfigurations — debug mode, HTTPS, application key, two-factor adoption — and lets you fix several of them without SSH access: toggle debug mode, clear the cache, or correct APP_URL's scheme, all from the browser.