Ping and ssh are pretty much never the things being hacked though. Turn password auth off and it’s very secure.

What gets hacked all the time is the actual web app itself. Which has to be exposed to be useful.