A very effective first step is to put it on a vhost with a domain you control, and drop traffic to the default vhost. 99.999% of scanners are just going through IPs looking for stuff, so don’t give them anything. Better yet, block any IP that scans you more than a dozen or so times.
Obviously some stuff will find you through cert issuance logs, but most of the bastards don’t bother with that level of sophistication.
Don’t our bills have to go through a legal review process? The charter is pretty clear on stuff like this… It’s pretty obvious this is dead in the water whether our MPs like it or not. But they’ll keep trying until they get what they want.