A long time ago, I turned a PC in my basement into a web server. No DNS. Just a static IP address. Within 15 minutes, the logs showed it was getting scanned.

SSL encrypts traffic in-transit. You need to set up auth/access control. Even better, stick it behind a Web Application Firewall.

Or set up a tunnel. Cloudflare offers a free one: developers.cloudflare.com/…/cloudflare-tunnel/