How about use a WAF, and a good security-centered one, not something off the shelf just to say you have a WAF.

For one.