"PermitRootLogin no and SSH is hardened"

"PermitRootLogin no and SSH is hardened"
That's step one of ten. Attackers don't need root to ruin you — a cracked deploy user with sudo and a password is game over.
Real hardening stack:
— PermitRootLogin no
— PasswordAuthentication no (the actual win)
— MaxAuthTries 3
— AllowUsers deploy — whitelist, don't blacklist
Killing passwords does 90% of the work. Root toggle alone is a false sense of safety. Try it tonight.