How secure are the preconfigured Droplets (e.g. Ghost installation)?

I just did this recently and one thing definitely stood out to me when I was following the tutorial for using Ghost with Digital Ocean.

Once it’s set up you barely have to do any configuration; if I remember correctly the only thing I had to do was set up my server name. However, the problem is that the droplets don’t have HTTPS support by default, since they can’t set it up for you, so you should probably get an SSL certificate and enable HTTPS so that the admin login page won’t be done through HTTP.

You should put additional security measures in place from the ground up. For instance you could explore:

Setting up SSH keys and spinning up your droplets with them.

Setting up UFW on your droplet is an easy way to configure IP Tables.

You could configure port knocking for some obscurity of your ssh access but setting up ssh keys is usually good enough.

PS: Already It’s been said that Ghost is more secure than other popular blogging platforms.