[inigyou]

> If you want to prevent "bot attacks", maybe the "Block" option will do the trick.

This morning, for the first time, I clicked on a link posted on HN and was told in no uncertain terms that I am a bot and will not be allowed to view this page. By Cloudflare.

Your strategy is fine and similar to one of the checks in go-away. The point is that the unknown global DDoS adversary is using a very simple scraper, which does not load images or CSS or scripts, does not set cookies, etc

[nirui]

Yes, it only work if the scraper, or rather scrapers cannot collaborate in a smart way (for example, doing Cookie sharing among themselves). That's limited by how Cloudflare page rule work, it don't really support anything that is too "dynamic", for example you can't concat/mix a Cookie with a Request date and then compare it, you can only check if there's a Cookie or Request date match a static value.

If you want something more powerful, there's also Cloudflare workers, which you can program to do whatever you want. But that one may cost you to run.

Also in my case, the scraper IPs are all over the globe, and almost each access is from a different one, so simple IP blocking don't work unless I block Vietnam, Brazil, Bangladesh, Argentina and the US etc (https://i.imgur.com/eWI5meM.png). But then, the scrapers might just go to another country next month.

Since I deployed those rules, the access from scrapers has almost stopped, while normal search engine crawls are almost unaffected. So it do still work for me, even if it's very rudimentary. But hey, security though obscurity it alone is not enough, but it sometimes do delay the attacks.