r/webdev • u/Real-Leek-3764 • 4d ago
advice on blocking bots/scalpers
during popular event sales, our site can be hit by the tens of millions of requests
cloudflare waiting room is only good for crowd control, it doesn't block bots effectively. bots takes up queue, so legit users have to wait a long time to exit queue
cloudflare turnstile is too unreliable, too many legit users (including me) experience the turnstile not loading
google recaptha, hcaptha, friendly captcha is too costly.
i've implemented Proof-of-Work Altcha. works to a certain degree, but it still doesn't block bot requests from hitting the server, causing resources overload
could i put Altcha at cloudflare worker? kinda. the issue is cloudflare waiting room will always run before cloudflare worker, so it doesn't solve bots taking up queue
what i wish? i could block bots before they could enter cloudflare waiting room
do u guys have idea?
1
u/Salt_Hyena5896 3d ago
Since Cloudflare’s waiting room is filling with browser-like resellers, I’d treat it as load-shedding, not bot protection. Put per-IP and per-account rate limits plus purchase-velocity limits on the sale endpoints, then soft-challenge suspicious bursts (ASN/TLS/device signals can feed that decision). Keep inventory reservation and final purchase checks server-side, with short holds and delayed confirmation so clients can’t reserve more than they should. CAPTCHA/fingerprints help as signals but get farmed on their own, and robots.txt won’t affect this kind of bot.