What are best practices for securing the admin section of a website?

Creating custom Principles is a common practice, although a common mistake is making them modifiable and/or rights enumerable. Although its not just an admin issue, it's more important since here is where users are likely to have elevated rights. Be sure they're immutable and not enumerable. Additionally, make sure all assessments for Authorization are made based on the Principal. [By JoeGeeky on a closed StackOverflow question](http://stackoverflow.com/a/2851584)