@doot@glitterkitten.co.uk @tobi im intermittently working on a new Mastodon frontend that could prevent some of this, allowing 4.x to disable unauthenticated api while still having working static pages for profiles/threads. Needs more work though, and in your case would also need integration with managed hosting