is it enough to use caddy and your own domain name for more security ?

[TheDreadPirate]

If you expose port 22 for remote shell access, that is a different story. But you can take extra steps to protect yourself.

The primary way I protect ssh is by using PKI ONLY, no password logins via ssh. That significantly increases the difficulty of gaining access via brute force.

I'll add to this.  Although very simple, if and when I do want to SSH remotely, I run SSH on a non-standard port.  Back in the day, when I ran SSH on port 22, the amount of remote failed login attempts from bots in my log files was insane.  Picking a random port helped a lot.

This.  Very much this.  I also run all of my services on non-standard ports.  Except for the Matrix federation port.  Back when I was young and dumb, I had MS RDP on its standard port exposed publicly.  Thousands and thousands and thousands of failed login attempts.  Lesson learned.

Just don't become lazy with your other security best practices because you think "security by obscurity" is enough.