Most SSH hardening advice starts and ends with two changes: move off port 22 and disable root login. Both are easy to implement, both are widely recommended, and both are almost entirely misunderstood.
Port 22 is the TCP port that accepts the initial SSH handshake. It does not control how authentication is performed, which cryptographic algorithms are negotiated, or what a user is allowed to do after connecting. Changing the port does not strengthen encryption, alter the authentication model, or meaningfully restrict access.
Internet-facing SSH services on port 22 receive continuous automated traffic: credential stuffing attempts, key-based probes, and banner scans. Moving SSH to a non-standard port reduces this background noise and can make logs easier to analyze, but any exposed port will eventually be discovered and scanned.
The real security posture of an SSH deployment is determined by the cryptographic algorithms negotiated during key exchange, the authentication model enforced by sshd_config, forwarding rules that may create unintended access paths, and the presence or absence of connection rate limiting before sshd processes a request. Hardening SSH is about how access is defined, controlled, and enforced, not about where the service listens.
