What is the best way to secure a web server?

I currently have Fail2Ban, DenyHosts, and Snort set up. Reading around, many people have said to change the ssh port from 22 to something else. Should this be done, if so what port is the best to change it too? Does all of these precautions protect me from DDoS attacks, if not what should I do? Finally, is there anything else I should do to make it secure?