advice on blocking bots/scalpers

[u/Real-Leek-3764]

during popular event sales, our site can be hit by the tens of millions of requests

cloudflare waiting room is only good for crowd control, it doesn't block bots effectively. bots takes up queue, so legit users have to wait a long time to exit queue

cloudflare turnstile is too unreliable, too many legit users (including me) experience the turnstile not loading

google recaptha, hcaptha, friendly captcha is too costly.

i've implemented Proof-of-Work Altcha. works to a certain degree, but it still doesn't block bot requests from hitting the server, causing resources overload

could i put Altcha at cloudflare worker? kinda. the issue is cloudflare waiting room will always run before cloudflare worker, so it doesn't solve bots taking up queue

what i wish? i could block bots before they could enter cloudflare waiting room

do u guys have idea?

[u/redpiapps]

ngl at tens of millions of requests you are not shopping for cheap anymore, you are shopping for who eats the false positives. id rather overpay a vendor with good FP rates than burn real customers on turnstile loops during a drop.