I think a practice web site would be a fantastic idea. Just as importantly as this is though, a second web site or the web site duplicated in a different folder should also be setup where everything is setup with each page having an explanation of how it is now secure and what was done to make it secure. It is one thing to figure out how to break into a website but another to figure out what to do to make sure that the websites that you develop do not end up suffering the same fate.