The multifactor can’t be understated as part of your security stance! I turn it on and enforce it on my home network for any service I host that supports it. And like mentioned elsewhere, only 80 and 443 are opened and they go straight through a proxy.