At the end of the day, if you know where your single point of failure/entry is, it is that point that you should secure to whatever degree is feasible in your situation. Web servers unfortunately have tons of attack vectors available.