Security settings that are worth turning on

Not all of them, and not blindly. Which switches actually reduce risk on a small site, and which only make it harder to log in.