For my server, secure enough. Just the basic recommendations, non-standard ssh port, default deny on firewall, fail2ban, etc. It doesn't need a lot of security because its just a static website. For most projects this is enough.

I will say, a honeypot can be useful and I'm getting one set up but its a low priority for me.