Tor: How do I secure an onion service?

Short answer

Protect the onion service's private key, keep Tor and the web server updated, restrict access to the local service, and check that pages do not leak the host's real address or other identifying details. Add client authorization if the service should be private. The Tor Project's setup guide also recommends testing the service and reviewing operational-security guidance before publicizing its address.

Sources

Tor Project: Set up an onion service.