Best method is to use an external hoster for the web site. 
QNAP has often been hacked in history, and providing NAS to internet (even, if “only” web server is accessible) is a bad idea.
HTTPS does not protect you in any way from being hacked.
Regards