That is such an easy fix. I can't believe this is not the default on all devices with an HTTP server. Of course this wouldn't stop attacks or even entire-internet scans (does Shodan respect that?) but would make discovery way harder.

Brb going through all software I ever wrote looking whether they could benefit from this too.