https://medium.com/cloud-security/how-network-traffic-got-me...
"After I figured out how to turn off the malware, I went back to my hosting company. I didn’t bother to tell them what I discovered because at this point it seemed futile. I just asked them to deny outbound network access I didn’t need. My computer didn’t initiate outbound connections to anything. It only replied to requests it received. I only wanted to allow the most minimal traffic required for my applications to run correctly. They argued with me! They said no one checks outbound traffic. I said I didn’t care what everyone else does. I wanted to block it. I figured out how to do it myself. I had very restrictive network rules in my firewall settings that only allowed what the applications on my server required."
Of course you don't want to block your web servers ability to get updates. But it is important to understand that web servers are web SERVERS. This means that they rarely initiate a new connection, they receive new connections from web browsers.