I'd add rate-limits. They need to be tested, but once working, it tremendously helps managing the site load, especially with regards to malicious scarpers/crawlers.