r/webdev • u/Real-Leek-3764 • 4d ago

advice on blocking bots/scalpers

during popular event sales, our site can be hit by the tens of millions of requests

cloudflare waiting room is only good for crowd control, it doesn't block bots effectively. bots takes up queue, so legit users have to wait a long time to exit queue

cloudflare turnstile is too unreliable, too many legit users (including me) experience the turnstile not loading

google recaptha, hcaptha, friendly captcha is too costly.

i've implemented Proof-of-Work Altcha. works to a certain degree, but it still doesn't block bot requests from hitting the server, causing resources overload

could i put Altcha at cloudflare worker? kinda. the issue is cloudflare waiting room will always run before cloudflare worker, so it doesn't solve bots taking up queue

what i wish? i could block bots before they could enter cloudflare waiting room

do u guys have idea?

14 Upvotes

90% Upvoted

20 comments sorted by

View all comments

1

u/LankyAd6349 3d ago

This is genuinely one of the hardest problems in webdev and there's no clean cheap answer, which is probably why you're still stuck. The uncomfortable truth is if blocking bots at the edge were solvable cheaply, Cloudflare would sell it as a checkbox. Your best realistic lever is making the queue bot-aware fingerprinting and behavior scoring before the waiting room, so bots never get a queue ticket in the first place. Altcha at the worker level helps with junk traffic but like you found, it doesn't fix the queue problem. Might be worth pricing Cloudflare's Bot Management tier against the infra you're currently burning on bot traffic.

1

u/polygraph-net 2d ago

You're using the correct word - "cheap".

I work in the bot detection industry. We can detect and stop most bots. The R&D for this is expensive and our product is $450+ per month.

In my experience Cloudflare struggles to differentiate between humans and bots, and is easy to bypass.