I once worked with one of those heroic security guys before. He setup the firewall so that the public website was only accessible from a white list of known up

I once worked with one of those heroic security guys before. He setup the firewall so that the public website was only accessible from a white list of known up addresses. New users would need to submit their IP address to him in person before they’d be allowed to browse the site. He insisted that this was industry best practice and it took two weeks before the site was online again.