Security is a set of layers: keep management private, patch the operating system, update WordPress, reduce plugins, and use Cloudflare as an additional edge layer rather than the only defense.
A public scan should only expose services you intentionally published, while WordPress and the OS remain fully updated.
Step-by-step
Update everything
Apply Linux updates and keep WordPress core, themes, and plugins current. Security fixes are only useful after they are installed.
sudo apt update
sudo apt full-upgrade -yRestrict CloudPanel and SSH
Whitelist management ports to trusted source addresses when possible. If that is impractical, use a VPN and add strong authentication controls.
Enable WordPress security controls
Use strong unique credentials, two-factor authentication where available, and a security plugin only if you understand the features you enable.
Reduce attack surface
Delete unused plugins and themes, disable features you do not need, and keep database and management ports off the public Internet.
Review file permissions
WordPress files should not be world-writable. Use ownership and permissions appropriate to your CloudPanel site user rather than blanket chmod 777 fixes.
Protect the origin
If your design allows it, restrict public web ports so only Cloudflare networks can reach the origin. Test carefully before locking it down so you do not cut off required traffic.
A public scan should only expose services you intentionally published, while WordPress and the OS remain fully updated.
Troubleshooting
If a command or screen differs from the lesson, stop and verify the version you are using before forcing a change.
What you learned
You now understand the purpose of this part of the system and have a concrete result you can verify before continuing to the next lesson.