As someone who is bootstrapping a web app all alone I really appreciated this. I know a few people are getting hung up on some "wrong" points but after looking into it I have to say that obviously one shouldn't just implement these measures exactly as written. Everyone's mileage will vary. The point is to consider these options and implement them in a smart way. That means keeping SSH on 22 if using fail2ban. Sure, SSH and Apache don't have much to do with each other but any thinking person gets the point: you're running a web server on apache and access it over ssh all the time, therefore make sure to secure that connection regardless of your chosen web server software.

I dont get all the negativity. Those are some common sense things that can be easily overlooked. I thinking blocking entire countries may not be smart for business but you never know who might want that. I'd also add disabling the root user, installing a software firewall like ufw, and invest in an SSL cert (they're not that expensive compared to the losses you could incur should some ass decide to attack your server). Thanks for this. Merry Christmas.