UFW is great at what it does, but it's not going to save you from web application attacks.

I found that over time ufw becomes unwieldy and it's hard to make sure you keep the rules consistent - even (especially?) with configuration management.

I highly recommend firewalld instead.