Access switch best practices

Which features you usually add 'by default' for your access switches? We have L2/L3 at the distribution level so the "L2 area" is somewhat limited, for example STP isn't spanning the whole enterprise

This is the first list of things I came up

Radius authentication syslogging to a central server NTP servers STP, client ports as host ports + BPDU guard STP at distribution - rootguard UDLD between distribution and access DHCP snooping to host ports 

Do you use port security? Or anything else I should consider as default?

Thanks!