Reduce the attack surface
Start with the services the server actually needs. Remove or disable unnecessary packages and network listeners, and keep the operating system and applications patched through a controlled process.
Server hardening is most effective when it follows the workload rather than applying an unexplained collection of settings.
Protect administrative access
Use strong authentication, restrict administrative access to appropriate networks or identity controls, and keep privileged access separate from ordinary user activity where practical.
Record administrative changes and keep configuration backups so the environment can be reviewed and recovered.
Monitor what matters
Logging and monitoring should provide enough information to detect failures, unexpected access and important configuration changes. Keep the monitoring scope focused on actionable signals.