Headers, transport and the hardening work that fits in an afternoon.
Escaping tries to neutralize dangerous characters. Parameterization removes the question by never letting data be parsed as code. Here is the difference, the PDO settings most tutorials skip, and the three places a placeholder cannot save you.
CSRF exploits one browser behavior: cookies are attached automatically, no matter who initiated the request. Tokens work because an attacker can make your browser send a request but cannot read your page to find the token. Here is the whole mechanism, with working PHP.
Hosting & Deployment Web Security
Certificates are free and automated, which is why the remaining failures are so consistent: a missing intermediate that only breaks on some clients, and a renewal cron that fetches a new certificate the server never loads. Here is how to verify both from the command line.