Lock down your server without locking yourself out
Every open port, every running service, and every exposed login is a potential entry point for attackers. When you port-forwarded ports 80 and 443, you also exposed port 22 (SSH) if your router forwards it. The goal is to minimize what is reachable while keeping what you need functional.
Uncomplicated Firewall uses a simple rule: deny everything, then explicitly allow only the traffic you need. This is the foundation of secure networking. Every rule you add is a deliberate hole in the wall.
ssh opens port 22 — needed for remote management'Apache Full' opens ports 80 and 443 — needed for web trafficIf you are SSH'd in and UFW blocks port 22, your current connection usually stays alive. But new connections fail. If you get locked out, you must physically access the server and run sudo ufw disable from the local console.
Passwords can be guessed, brute-forced, or leaked. SSH keys use public-key cryptography: a private key stays on your computer, and a public key sits on the server. The server encrypts a challenge with the public key; only your private key can decrypt it. No password ever travels over the wire.
~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public)~/.ssh/authorized_keys on the serverFind and change these lines:
Before disabling password authentication, verify your key login works in a separate terminal window. If you lock yourself out, you need physical access to the server to fix it.
Security patches are released constantly. If you forget to update, your server becomes vulnerable to known exploits. unattended-upgrades automatically installs security patches in the background, so you are always protected without remembering to run apt upgrade.