User port configuration guideline on Cisco switches

For the best security and service, the following configuration should be applied to switch ports that connect to end users (applicable in most scenario)

switch port-security
switch port-security maximum 1 (3 for port that connects to VoIP phone)
switch port-security violation shutdown
switchport host
spanning-tree bpdufilter enable
no cdp enable
storm-control broadcast include multicast
storm-control broadcast level 0.1
storm-control broadcast shutdown

Spanning Tree Protocol most noticeable questions

What happens when whole network first boots up?
What happens after network converges?
What happens when new switch is added to network?
What should be done before adding new switch?
What happens when switch port up/down?
What happens when STP configuration on a switch is changed?