Getting your head into RaspberryPi security.
TL;DR Having previously setup the RPi as a headless device logging in over ssh
here the default password was changed. However, if the RPi is to function as a server then adding a new superuser, deleting the default pi user, enabling passwordless login using ssh keys, disabling password login, restricting incoming connections to port 22 only, banning IPs that fail repeatedly and setting up a restart watchdog timer will go some way to hardening the diminutive server.
UPDATE: "macOS keeps asking my ssh passphrase since I updated to Sierra" *sigh* do this:
ssh-add -K
This stores passphrases in your keychain.