is there somewhere a short best-practices-guideline for a fresh install?
Because: I’ve seen that some are blocked some IP-Ranges, some added spam filter, some installed Antivirus. I’m having 25 years experience and wondering what is really necessary and what not. And I’ve seen that some are using Hestia as Solution for managing her customers. Only for personal interest (no - I will not take customer) , how do you manage abuse messages from external and your customers generally? Are there no solutions who are more suitable for larger amounts of customer?
Well, there is no single best practice since it depends on the use case; every server is different because needs vary. Setting up a server that runs static pages is different, a blog has different needs, and hosting an e-shop requires something else entirely. In cases with an e-shop, you will definitely need IP blocking lists because it gets crazy, especially now with AI. You will definitely need an antivirus (AV) because many users upload nulled plugins, themes, and so on. To me, all of these are essential, and we provide all of them—you just need the right configuration. As for emails, the same applies regarding what limits you use to prevent users from abusing the system and getting the server’s IP blacklisted.
I setup a minimal Debian 13 server with ssh access and full stack HestiaCP from the Install | Hestia Control Panel page changing only hostname, username, email and password and MultiPHP if I require earlier versions. The system prompts to remove exim4, I say please do and keep notes on any small changes I must make such as hostnamectl set-hostname in Debian 13 and so forth. Any other options that are needed can be easily added if need be either from scripts or simply changing an option in the panel itself (example some client needs php8.1 so can check that box on the panel and php8.1 will be installed or can just run the script for it). Enjoy!