So the strategy must essentially be to safeguard against all possible kinds of attacks by using all ”state-of-the-art” tools you can find (and then learn how to use them).

A probably inadequate list of such (free) hardening tools and utilities may include the following items (but you’ll have to do your own research, and decide which to employ, and figure out how to configure them):

-- Backup... always backup after every configuration change that seems to work.

-- Change the default username <pi> to something less obvious.

-- Change the default password to anything else (cannot be a palindrome, though).

-- Set up a fixed IP on LAN

-- Make your WLAN's IP fixed too (if it's dynamic and if your ISP lets you do so).

-- Enable SSH access with key based authorisation + passphrase.

-- Disable root-login via ssh.

-- Close port 21 and 22 from the internet. Leave only standard WWW port 80 open through the firewall.

-- Configure the default SSH port 22 to be some (much) higher random number. Of course, this number also has to be known to the computer you use to access the web server via SSH.

-- Install the DenyHosts tool.

-- Install, deploy and configure fail2ban.

-- Set "server_tokens off" in /etc/nginx/nginx.conf.

-- Deny execution of scripts inside certain directories.

-- Block Referral spam.

-- Deny all user-agents, bots or web-scanners that may attack your server.

-- Block any particularly nasty robots.

-- Have a look into ”Control Nginx Simultaneous Connections” and ”Control using limit_conn directive”.

-- Check for rootkits.

-- Do a ”sudo nmap -v -sS -p1-2000 localhost” once in awhile to check status of (at least) your first 2k ports.

-- If you don’t have the experience, you should probably seek advice on how to edit the ufw-rules.

-- When everything is tested and has been running stable for a convincingly long time, routine logging to /var/log/ufw.log kan be turned off. This is in order to reduce wear, by minimizing unnecessary writing to disc (sd-card).

-- And did I mention to backup?

Finally, to add both extra responsiveness and ultimate security, the web server can be configured to run completely in RAM, and hence never read or write to disk. The procedure is to (automatically) create a virtual RAM-disk on start-up onto which the entire website is simply copied from the sd-card. This means the content will always be loaded fresh and untarnished on a reboot. This was the route I choose for my server, and everything just works without any hiccups as far as I can tell. There is a definite improvement in (perceived) performance, with latency hardly noticeable when loading the pages from an external web browser.