shrug
In 25 years of hosting a dozen domain names on a server on my home connection, this problem has not surfaced for me.
One time has to be the first and when you get hacked they're instantly inside your network unless you were smart enough to set up a DMZ or something.
Especially if you host something like wordpress with plugins you really have to be on the ball with updates.
Yep, same here. fail2ban and some http 444 helps out.
In 20 years of managing server fleets, I always had the pleasure of watching bots taking a dig at my server(s) the moment I give their public IPs and enable their interfaces.
For someone who knows what they are doing, it's more like mosquito noise, a mere nuisance, but even then, using a rock solid system with all updates installed carries the risk of having a zero-day.
If your server is networked to the rest of the house, and if somebody manages to get in, then it's all fun(!).