that works too

For personal services, even something as simple as HTTP basic auth on the webserver dramatically reduces the attack surface by blocking all probers and drive-by attacks.