My servers generally have an IPv4 address and a whole IPv6 subnet. I like to disable SSH except on a specific IPv6 address. Many botnets just focus on IPv4 and

My servers generally have an IPv4 address and a whole IPv6 subnet. I like to disable SSH except on a specific IPv6 address. Many botnets just focus on IPv4 and there is a lot more territory to scan on IPv6. I usually couple that with moving to a non-standard port, enforcing modern encryption (ed25519 or ChaCha20, etcc), fail2ban, require SSH keys, etc