I wish I could say I had some solution that was free, or didn’t involve some outside service. I put my biggest forum behind bunny.net’s CDN. They have a generous free tier. But for that forum I go ahead and pay the $10/month to get their security service. It lets me block crawlers, DDoS, and geographically. As CDNs go, they’re really cheap but effective, and they’re not CloudFlare. A lot of folks on the fediverse rate them highly.
I’ve a graph from their Shield service. (I’m a n00b, only 1 graph per reply 
) In the first, there were 484K bot connections out of 2M overall connections. I had just moved to the CDN and didn’t have any filtering or blocking in. The next shows 11K bots, and 90K blocked due to access lists (I block China and Russia and maybe a couple others). So that’s about 100K from bots on a total of 700K requests that week.
After:
