Best practice for automatic deployment

I have multiple repositories on BitBucket.org. I want to run a git pull on my production server everytime a run a git push on my local machine. I have been looking around for the best solution but there seem a lot of different solutions for this.

Some say webhooks, but they seem a bit insecure to me. Ofcourse you could apply security through obscurity, but I'm not sure if this is really secure enough for a production server.

I could also set up a git hook and push to a other remote. But I want to always push to origin and not only to the production server.

So my question is, what is really the best practice for auto-deployment, without having to SSH into my production server and pull changes everytime I push something to the origin?