Basic firewall
Allow only the ports you use.
A new server answers on every port its programs open. Allow only what you need.
On Ubuntu and Debian: ufw allow OpenSSH, then ufw allow 80,443/tcp for a website, then ufw enable.
On AlmaLinux and Rocky Linux: firewall-cmd --permanent --add-service=ssh, then add http and https the same way, then firewall-cmd --reload.
Always allow SSH before turning the firewall on, or you will lock yourself out.