How to protect tiny, dynamic webservers from fedibombs?

For Apache:

RewriteEngine on
# Fediverse instances asking for previews
RewriteCond %{HTTP_USER_AGENT} Mastodon|Friendica|Pleroma [nocase]
# then it's forbidden
RewriteRule ^(.*)$ - [forbidden,last]

Add more user agents as the landscape changes…