Oh, one thing we're doing I forgot about:
- Check whether the files on the webserver are the same as the files that you expect to be there.
Ideally you'll have a tag or release in your source control system that you can compare against.
The point of this is to get notified when either someone modifies files on live deliberately (sometimes this is the only way to get visibility on a bug that only shows up on live, alas), or when an attacker modifies your files or uploads something new. Most attackers these days aren't there to deface your site, so you might not notice that your index page is now serving spam links to Googlebot user agents...