Protect access, not just the address
Internet scanners can find public services without following website links. robots.txt and noindex do not protect an IP address. Your goal is to make the origin accessible only through your protection layer.
Audit public DNS and services
Check A and AAAA records, old subdomains and unproxied hosts. A mail service or another website on the same IP can expose your origin. Remove unnecessary public records and separate services that need direct access.
Restrict incoming connections
Get the current HotWall addresses from the public list (see Allow HotWall IP addresses). Allow them to the application ports at your hosting firewall and on the server, then deny other sources. Apply the policy to both IPv4 and IPv6.
Keep SSH and admin access behind a VPN or an explicit administrator allowlist. Preserve a recovery console and test access before applying a default-deny policy. Do not copy another provider’s IP ranges.
Allow HotWall IP addressesClose the remaining paths
Use HTTPS to the origin with certificate validation. Ask support whether origin authentication or a private connection is available for your setup. Disable unused listeners and reject unknown Host headers; these controls supplement the firewall.
Check the result
From a network outside the allowlist, direct origin requests should fail while the public website still works through HotWall. Test IPv4, IPv6 and every application port. After fixing leaks, consider changing an already exposed origin IP.
Blocking Censys scanning ranges can stop future scans from those ranges, but does not erase historical records or block other scanners. Use the current ranges in the official documentation; there is no guarantee of invisibility.