I keep most things inaccessible behind Tailscale. For any public things I 403 known crawlers when they access anything but robots.txt.