Quite easily done is moving ssh to a non standard port. Similarly force it to use public key only authentication and/or only allow specific users/groups to logi

Quite easily done is moving ssh to a non standard port. Similarly force it to use public key only authentication and/or only allow specific users/groups to login. Furthermore fail2ban or similar systems help prevent brute force attacks on ssh. You can also use something like pound, which is surprisingly easy to configure, in front of your main webserver and let is sanitise everything as it comes in. I would recommend having a firewall which allows only the bare minimum required, ie. http(s) and ssh, anything else you can set up to port forward through ssh without too much of an issue.