How would you architect a “standard” web application to protect the database?

OK imagine a "standard" web application. Some web server, some language like PHP, Ruby, whatever, some database Postgres, SQL server, MySQL, whatever.

How would you architect this to protect the database?

Would you have the database on a separate server?

Would you allow direct connections to the database from your web application code?

How would you defend your database in case hackers crack the web application server?