Changing the port cut the invalid auths from 1000s a day to 0. Why deal with and log that spam?
Depends, I don’t think the storage requirements for the spam is that high and I would rather just use grep than remember the nonstandard port I picked.
But I guess this is partly because I tend to look at logs a lot less than I SSH into my server.
But the ordering before that seem very reasonable. Although Wireguard is a soft alternative to changing default port, so it might be worth doing that.
On a slight tangent, I’ve never really bought into changing SSH port from default. I’d say the convenience of not having config/extra port specification is worth having it on a well known port, but that’s just my personal philosophy. I feel like for my low traffic things, just having strong SSH key and auto-updates is good enough.