This is incredibly helpful, thank you!

I'm definitely going to add fail2ban and UFW rate limiting to start with, and look into a firewall on the edge in the unlikely event that GoAccess shows a deluge of traffic. I feel a bit better at least knowing now what the weak point is, so thanks!