The company who provide internet to us implement treatment to the majority of the situation you have listed. They only recommend we don't use Mysql default port(3306) and also blocking the user ROOT for external access. We have our own server for years
