SSH is almost always a terrible idea to open on the internet. It’s just not worth the risk for the slight convenience. Web, VPN, etc… go for it. Just make sure you take appropriate precautions, fail2ban, geoip blocks and keep your exposed software patched. Use something like hostedscan to make sure you don’t have any known vulnerabilities exposed to the internet or obvious misconfigurations.

I additionally use crowdsec on my webserver it functions as a slightly more intelligent fail2ban. It rarely triggers but it’s a nice additional layer. My fail2ban triggers several times a day. I’ve got it following my default virtual host and banning anyone that hits it (if you don’t at a minimum know my external hostnames then you have no business accessing my ports).

For me, it’s no more reddit on mobile but I’m not blocking it any time soon. If it’s a Google result, so be it, there’s still useful content over there.