1. Make the entire site available under `ssl.washingtonpost.com` (ideally without the `.ssl` prefix).
That way, the domain won't be as suspicious as it is right now. I suspect that this is more or less the only content hosted on the domain.
2. Include an iframe for all (or a random subset of) visitors, loading this particular url (hidden).
By artificially generating traffic to the endpoint it will be harder to distinguish these from other, 'real' requests.
Use a random delay for adding the iframe (otherwise the 'pairing' with the initial http request may distinguish this traffic).
3. Print the link, url and info block on the dead trees (the paper), as other has suggested.
4. Add HSTS headers (http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)
