Web Security: Worst-Case Situation
Https is a must, but you also have to come to terms with the fact that no site can be 100% secure.  The only other way for you to get a significant improvement in security is to have very short session timeouts and provide you users with hardware tokens, but even tokens can be stolen.
I currently have built a system that checks user IP, browser, and a random-string cookie to determine if he is an admin.
In the worst case, someone steals my cookie, uses the same browser I do, and masks his IP to appear as mine. Is there another layer of security I should add onto my script to make it more secure?
EDIT: To clarify: my website accepts absolutely NO input from users. I'm just designing a back-end admin panel to make it easier to update database entries.