Any protection of this kind is best done elsewhere e.g. in the frontend proxy.
See https://phabricator.apertis.org/T8569