[wanderingpixel]

It depends on what you define as unwanted traffic.

Personally I do not have an issue with bots as long as they behave and are not straight up malicious, so I rely on a combination of rate limiting, a fine-tuned OWASP CRS ruleset and an aggressive Fail2ban enforcement (hit 2 triggers and you get a 24 hour ban, 2 bans and you get banned for 30 days).

My sites also make extensive use of static elements and caching.

[prologic]

How do you deal with DDoS attacks on your infra / sites? Especially ones from residential proxies or vpn networks? These are the hardest to defend against as they often are relentless and no amount of proof-of-work, captchas or otherwise seems to stop them from coming. I don't think it's something you can easily block at any firewall level, the sheer volume of IP(s) and Subnets is too much.

[wanderingpixel]

I limit slow requests with mod_reqtimeout and have e.g. reduced request body limits as I don't accept large uploads.

A real sustained DDoS would probably still require upstream handling by larger infrastructure than I run.