Ensure that environments are only running when they are actively needed.
Hard to implement
5 High impact score
The multiple environments that make up a website (Dev, Test, UAT, Prod, DR) should each be managed according to the habits of the people who actually use them. If a non-production environment is only used during working hours, turn it off outside of them, there’s no reason a test environment should be burning compute at 2am when nobody is testing anything.
A serverless environment achieves the same outcome automatically: these tools transparently spin servers up and down and allocate resources on a per-request basis, so idle time genuinely costs nothing rather than relying on someone remembering to shut things down.