The Wireguard VPN protocol doesn’t reply to any packets that aren’t cryptographically authenticated, so that’s a good option if you want something “unscannable”

The Wireguard VPN protocol doesn’t reply to any packets that aren’t cryptographically authenticated, so that’s a good option if you want something “unscannable” on the internet. For a regular, publicly accessible server, you do want people to be able to connect to it, so it must be scannable. I don’t know offhand, but with HTTP/3’s udp based protocol, it ought to be possible to at least make scanning a bit trickier. By requiring a valid QUIC client hello packet, with a valid SNI header for that server, the scanner must know the name of the server it’s trying to talk to. I don’t have any experience with HTTP/3 yet so I am probably wrong.