A Minecraft server security checklist

Most server problems come from a few easy mistakes. Go through this list once.

Keep online-mode=true. It checks players against Mojang. Turning it off lets anyone join under any name, including yours.
Use the whitelist on private servers: how.
Op very few people. An operator can run any command. Use permissions (LuckPerms) for helpers.
Update the server and plugins. Old versions have known holes: update safely.
Update Log4j-era plugins and remove abandoned ones.
Back up often and keep copies away from the server: backups.
Do not share the control panel login. Add helpers with their own accounts and roles.
Turn on two-factor sign-in for your hosting account.
Use SFTP with keys or tokens, not shared passwords: SFTP.
Install only plugins you need, from trusted sources such as Modrinth, Hangar or SpigotMC.
Log activity with CoreProtect so you can see and undo griefing.
Know how to stop a raid: ban players, IP ban and close for maintenance.

Behind a proxy

If you run a network with Velocity, keep the backend servers unreachable from the internet and use the forwarding secret. See networks with Velocity.

A host handles the network layer, backups and firewalls for you. Read what hosting is.