Bind to localhost or private interface (bind 127.0.0.1)
Enable requirepass / ACLs (Redis 6+) with fine-grained command/key permissions
Use TLS (tls-port, tls-cert-file) for in-transit encryption
Disable dangerous commands: rename-command FLUSHALL "", rename-command CONFIG ""
Run Redis in a dedicated network namespace / VPC subnet
Enable protected-mode yes