I have ports 80 and 443 open on my WAN and forwarded to the server on the LAN. My websites are static (apart from an isso commenting server), so I guess the risk of someone taking control of the server is low... But I'm not sure if that's the right way to do it