I don't know the basic configuration of ufw, however since you mentioned allowing ports, here are some thoughts:
- blocking ports for incoming traffic does not means enhancing security. I mean if you block port which is not opened (ie. no service is listening on that port) is mainly security by obscurity ;
- blocking ports for outgoing traffic may be sometimes blocking. You cannot block ports > 1024, since you will block all outgoing connection initiated by your server (ssh client, http client, dns requests from your server, ...) ;
- you then can block traffic initiated by your server on ports < 1024 (eg. TCP traffic with SYN flag which source IP is your server) in order to prevent an attacker that already has access to your server to communicate from your server. But this would not be very useful as (as seen in the previous bullet) outgoing communication can be done through higher port range.
But what you can really do is to reduce the attack surface by:
- restrict to the minimum services your server is running (even if it is not public). For example, shut down your http server (nginx, apache, ..) if you do not use it ;
- avoid installing unmaintained software ;
- always update softwares (and any components, eg. wordpress core and plugins)
- secure ssh (take a look at https://www.debian.org/doc/manuals/securing-debian-howto/ch-sec-services.fr.html)
- use ssh keys instead of passwords. You can also set up 2FA
- white-list users whic are granted to access your server
- you can set up port knocking on you listening ports (eg. ssh)
- you can use other tools to help you enhancing security (fail2ban, ...)
There are many other advice that community can give you, but do not forget that security is not a one shot action, security is a permanent action (updates, log monitoring, ...).