
You should never ever expose a VPS to the entire internet Always firewall it to subnets If you host a website you should only allow port 443 (HTTPS) inbound from Cloudflare's IP range / subnets Port 22 (SSH) only from your Tailscale subnet range That means you create a "tunnel" from Cloudflare and Tailscale (your laptop) to your server's door You still need your SSH key to open the door btw If you don't, ANYONE in the entire world can connect to your VPS and if there's just one security vulnerability and you didn't upgrade your VPS you can get hacked If you do have it firewalled with Tailscale subnet only, it means only if they hack your laptop they could get in via your Tailscale there Another thing is ask OpenClaw or Claude Code to enable unattended upgrades with auto reboot




























