We used to call it bastion host but yes. Rent a few physical machines around the world, make production SSH firewalled off from everywhere except those ones. No

We used to call it bastion host but yes. Rent a few physical machines around the world, make production SSH firewalled off from everywhere except those ones. Now you only need to worry about all the security holes in your web app stack which are of course quite numerous... but at least you are not bothered by SSH bots.