I can't stress this enough but if you're going to deploy a web application you need to be serious about and learn about web security.

https://www.owasp.org is a good place to start.

Windows is just fine, it's a personal preference. I learned (mostly) on Linux but I use Windows at work, whatever.