It all depends on your privacy settings.
The default for actions is often that "friends of friends" can see actions.
You can control the visibility of a post when you post it. Make sure the default action for that is "Friends" only. This can be done on the Privacy Settings and Tools page via the "Who can see my stuff?" option:

Then go to the Timeline and Tagging Settings page and make sure that the "Who can see what others post on your timeline?" option is set to "Friends" only rather than "Friends of friends".

These options change regularly so it's always worth double checking the settings and making sure only those people you want to interact with are able to see what you post.