BehindTheMath

At least it's not 4.

You don't need mTLS for that. Just block all IPs beside for Cloudflare's ranges.

I haven't used iodine, but this seems simpler. Iodine wraps requests with actual DNS requests. In this case that wasn't needed, because port 53 wasn't filtered at all. So all they needed was a simple proxy on port 53.

What's wrong with Amcrest IP cameras?

aria-hidden="true" should take care of that.

Check out Modsecurity WAF and CoreRuleSet.

Doesn't that mean that you're charging extra from those that don't care about updates to subsidize them for those that do?

Can't you check the Referer?

It's linked in the post.

Why not Cloud Domains?

Nearly all Israeli Haredi Jews speak Hebrew. For most, it's their primary language. Most do not speak Yiddish.

Isn't the point of salting to prevent dictionary attacks? That's still auth 101.