Networking and certificates: domain, DNS and HTTPS
The basics
Domain records point to the server or the delivery network; their cache time sets how fast a change takes effect. Before a planned move, lower that time in advance.
Encryption in transit is the default, including an automatic redirect from the unencrypted version, and including subdomains.
Certificates
Automatic renewal, and monitoring that alerts two weeks in advance. An expired certificate is one of the most common and embarrassing production incidents, and it's entirely avoidable.
What else is worth setting up
Sender-authentication records for email, basic security headers in the response, and a policy of allowed origins for cross-domain requests — defined as a closed list, not a wildcard.
Going deeper
Keep a list of every domain, who the registrar is, when it expires, and who the owner is in the organization. An expired domain is both a business and a security risk — whoever buys it inherits the mail and the trust built up in it.