Firewall
A firewall filters network traffic by rules: ports open only to what is strictly needed, sources restricted where possible. The first line of defense for any exposed server.
In practice
The base rule: close everything, then open by name — web, hardened SSH, mail if applicable. Hosting-layer firewalls sometimes compound the system-level one: a rule forgotten at either tier and the service is silent with no visible error. Documenting every opening prevents archaeology months later.