The first is to pay attention to:

• Static classes and attributes.
• Subscribe to events. Garbage collector does not collect objects on which someone else signed.
• Any external resources that are not closed properly: all files, DB connection, etc.
• Settings for the user session.