This only makes sense if it's the only form of security, which would be stupid. I had my personal server on p22, and got thousands of attempted attacks a day.

This only makes sense if it's the only form of security, which would be stupid. I had my personal server on p22, and got thousands of attempted attacks a day. I don't allow password authentication, only a key. I moved the default port not to reduce my risk too much, but to reduce the total number of attempts. Just by moving the default port, unsuccessful attempt dropped by 100x.