What are best practices for securing the admin section of a website?

When any account receives a select number of rights, all the admins and the security officer are immediately notified via email. This makes sure that if an attacker elevates rights we know right away. These rights generally revolve around priviledged rights, rights to see privacy protected information, and/or financial information (e.g. credit cards). [By JoeGeeky on a closed StackOverflow question](http://stackoverflow.com/a/2851584)