Anything I don't share with other users (ie the stuff I host for just me) isn't accessible from WAN. Instead I host OpenVPN so my mobile devices are kept within my LAN and securely accessing my services. (also keeps them behind pihole for adblocking and local DNS records)