Are R2 security settings sufficient?

admin

To prevent being mjjed, I read several blogs.
Please ask the experts, will it be enough?
If not, what else can be done?
All https


Cache should also be updated, it seems that the maximum is 500M.


WAF should be configured.


I actually want to use API to turn off ipv6, but you don't know how to do it if I wrote an article before.
https://www.nodeseek.com/post-10868-1
So as not to be the same as him, IPv6 was completely blocked, but modifying hosts still seems to work.
This guy uses his own tunnel to do it.

He was taught by Mjj R2 was hacked over 1 million times.
https://hostloc.com/thread-1204659-1-1.html
(From Global Host Forum)

Five-second shield should probably not be opened, right?
https://hostloc.com/thread-1094822-1-1.html