Know the destination
Record the server address, SSH port and expected administrator account. Verify the host identity through a trusted channel before accepting a new host key. A saved host key helps detect an unexpected change on a later connection.
Protect the key
Keep the private key on the administrator device and avoid sharing it through tickets or public repositories. Use separate access where multiple people administer a system. Record how access is removed when it is no longer needed.
Keep a recovery route
Before changing SSH or firewall settings, keep the existing session open and test a second connection. Confirm console or another approved recovery method is available. A configuration that looks correct in a file can still prevent the next login.
Change deliberately
Make one access change at a time, validate the configuration and test from the network you expect to use. Keep notes outside the server so they remain available during a failure. Access planning is a routine maintenance task, not something to invent after a lockout.