I have a small home network and I'm trying to balance the need for security versus convenience. The safest way to secure internal web servers is to only connect using VPNs but this seems overkill to protect a DVRs remote web interface (for example).

As a compromise, would it be better to use very large ports numbers? (eg. five digits up to 65531)

I've read that port scanners typically only scan the first 10,000 ports so using very high port numbers is a bit more secure.

Is this true?

Are there better ways to protect web servers? (ie. web guis for applications)