Reduce origin exposure to Censys, Shodan and direct connections.
Get the current list of HotWall addresses and let only them reach your server.
Match requests and choose how your firewall responds.