I have that but with caddy.

On the caddyfile you can put to only serve the site to certain IPs and reject the others with any status normally 403 or 404.

Attackers probe the site, but all they get it’s a connection error.