A default install listens on more ports than you think. A firewall that denies by default turns "what might be exposed" into "what I deliberately opened", which is a much shorter list to reason about.

See what is listening first

ss -tulpn | grep LISTEN

Anything bound to 0.0.0.0 is reachable from the internet. A database that should only be reached locally must be bound to 127.0.0.1, and that is a fix in the service, not in the firewall.

Allow SSH before enabling

Enabling a default-deny firewall without allowing SSH first disconnects you and there is no way back in except the provider console. This is the single most common way people lock themselves out of a server.
ufw allow OpenSSH\nufw allow 80,443/tcp\nufw default deny incoming\nufw default allow outgoing\nufw enable

Check it

ufw status verbose

What a firewall does not do

  • It does not stop an attack on port 443 - that port is open by design, and everything that reaches your application arrives through it.
  • It does not patch anything. An out-of-date plugin is reached over the port you meant to open.
  • It does not protect against a stolen password on a service you allowed.

Rate-limit SSH

ufw limit OpenSSH

That refuses an address after six attempts in thirty seconds. With keys already required it is belt and braces, and it keeps the log readable.

Write down why each rule exists, in a comment. In a year the question "can I close this" has no answer without it, so nobody closes anything.