The last you want is for your setup to be compromised, be used to send spam/botnets and then getting perma-banned from your ISP.
I would argue it's a lot less risky just to put your static site on S3/Github etc.
And are basically free.
they just have more staff on hand to respond, run updates, and do the due diligence of checking and implementing patches.
Really easy to setup/use and means you don't have to open up ports like 22 which are constantly being port scanned.
You can also do things like firewalld off (or with hosts.allow) 22 to just an ssh bastion/jumphost src (or your house IP), but I find that’s usually not necessary (although an excellent further step if you are a bit paranoid) as long you do what was mentioned in first paragraph.
While you shouldn't skip on other security measures, there's no real downside to changing your SSH port and getting off the target list for a lot of botnets.
(As opposed to e.g. port knocking, which is stronger but makes it easy to lock yourself out and may create issues with some SSH clients.)
Far more people (at least 2 orders of magnitude) end up infected with malware and become members of botnets from just clicking dumb shit. They don’t get banned from the ISP either.
I know of friends who have been banned for doing exactly this.
I've been running servers used by family and friends from my home for about 20 years now. It's never been an issue at all.
Very hard to do and finicky to setup but at the time was suitable for my needs
This was merely weeks after telling him to switch to Tailscale, but it was a great learning experience.