Firewall baseline
A firewall rule is an operations decision, not only a command.
For a production web server, UFW should express what the server is meant to expose: SSH for admins, HTTP and HTTPS for users, and as little else as possible. The app port, database port, and admin tools need deliberate treatment.
UFW is popular because it makes host firewall management approachable. That simplicity is valuable, but it does not remove the need for planning. A good firewall setup starts with knowing the app architecture: which service receives public traffic, which service talks to the database, where Nginx sits, and how administrators recover if SSH is blocked.
Official source note: Ubuntu documents UFW as the uncomplicated firewall tool used to manage firewall rules on Ubuntu Server: Ubuntu firewall documentation.
