Use the firewall tool that fits your OS, then allow only the ports you actually need (such as SSH 22, HTTP 80, HTTPS 443).
Ubuntu/Debian (ufw):
sudo ufw allow OpenSSHsudo ufw allow 80,443/tcpsudo ufw enable
AlmaLinux/CentOS (firewalld):
sudo firewall-cmd --permanent --add-service=http --add-service=httpssudo firewall-cmd --reload
If you run a control panel, CSF is a popular alternative. Always keep your SSH port open before enabling the firewall, or you may lock yourself out, the VNC console in your VPS control panel can rescue you. On unmanaged plans this is your job; managed customers can open a ticket.