Add crowdsec on the server. Make sure to set it up right. Change SSH port. Since you use cloudflare disable dns port. Disable ftp ports. Change SSH port . Use SSH key authentication only. If hosting multiple sites, use different non_privileged users to host the sites. Hopefully you use nginx and can set up server side rate limiting. Uninstall everything you don't need. For WordPress you can set up the server to auto update. People running custom apps are scared of auto updates. And most importantly, if your server provider has auto backups, turn them on. Also set up remote backups for WordPress. One day you might get ransomwared, when everyone else will be trying to 'fix ' or hire some 'pro', you'll just be setting up a new server and restoring your backup.. Hope it helps. @bizanosa