The security of your Web server will entirely depend on the skill and commitment of the system administrators, both for the operating system and for the Web server software itself. It does not really matter whether the sysadmin is you or someone else; what matters is that the configuration is under control and security updates promptly applied.
Out of personal experience, I would recommend as OS one of the mainstream Linux distributions, e.g. Debian, Fedora or Ubuntu -- which one does not matter much as long as you regularly check for updates and apply them (by "regularly" I mean "on a daily basis"). The *BSD systems are also worthwhile alternatives (FreeBSD, NetBSD, OpenBSD) but they usually have less support from hosting services, and they require a bit more in-depth knowledge of what is going on in the OS entrails (however, their somewhat simpler, more traditional internal structure makes acquisition of such knowledge a bit easier than the Linux case). The relatively smaller user base of the *BSD systems also makes them less likely targets for attackers -- that's "Security through Attacker's Incompetence", which is even less reliable than "Security through Obscurity", but still works in practice.
If your are not the sysadmin of the Web server system, as you hint in another comment, then you rely on the actual sysadmins to do their job properly. This is one of these cases where you tend to get what you pay for. Luck will play a large role in that matter: when using shared hosting, you are nominally isolated from other customers of the same system, but in practice perfect isolation is not a given. Fortunately, most people are honest, as the continued existence of civilization tends to demonstrate.
For your access passwords, what matters most is that you use only "clean" machines. The longest password or the best "key file" on a USB stick will not save you if you type it or insert it in a compromised desktop system. Keeping a desktop system "clean" works along the same lines as keeping a server "clean": be wary of what you install, check for security updates. You do have a few extra possibilities with desktop systems; for instance, you could boot a "secure" system of a USB stick (or a USB external harddisk), without touching the internal hard disk. That way, you could maintain a separation of roles: the OS on the internal disk is for "risky" activities (Windows-based gaming, Web surfing...) while you the USB-booted system would be reserved for Web server administration.
SSL and SFTP are secure technologies, but only act as tunnels. They protect data in transit between two points (e.g. a Web browser on some user's machine, and the Web server) but they do nothing about the security of both end points. SSL and SFTP will not save your skin; it is more a case of not using them would create additional holes to contend with.
Disclaimer: I have presented fairly subjective opinions above about the comparative merits of operating systems. However, I consider that I have both enough experience and a sufficiently inflated ego to be entitled to make such assertions. Other people's experience may differ; I hear that there are some Windows sysadmins who are content with its security. The core assumption, however, is consensual: know your system. You won't get a lot of security as long as the OS and the software remain "magic" in your eyes. Knowledge dispels the magic.
