The best distro is the most secure distro. Any distro can become secure with enough work, it just so happens that RedHat and CentOS (rebuild of RedHat) are the most secure and manageable out of the gate.
You want to make sure your packages are actively receiving security patches and the default security policy makes sense. CentOS has extensive SELinux policies for most major packages, so your httpd or nginx installations are very secure by default. There is also a ton of hassle in dealing with CentOS. You have to actively maintain certain SELinux policies and booleans if your web-app does anything. This might include connecting to an outside database, having httpd-writeable files, or sending email.
CentOS is great because if you want your app to do things that might pose a security risk, you have to actively configure the server to allow things, whereas other distros often give you (the 16 year old kid) the keys and let you do whatever you want without much pain.
If you're hosting your own website for a project, then I'd go with something Debian-based, but if you're managing servers for a company, I'd certainly choose RedHat or CentOS.