[exiguus]

In my view, if blocking is necessary, whitelisting is generally more effective than blacklisting. And if whitelisting isn't feasible, this might be a poor solution.

On the other hand, tools like Cloudflare and Anubis can create serous accessibility issues; some more than others.

I prefer rate limiting; it's elegant and avoids accessibility problems. For temporary issues, short-term IP bans can also work well.

Personally, I use fail2ban to parse HTTP logs and temporarily ban IPs for N hours if they request forbidden URLs (e.g., those blocked by robots.txt or paths like wp-login.php). Same if a IP trigger the rate limit much to often. And currently, I'm testing Anubis on my Git web UI.

[Bender]

I agree whitelisting is great. I have used that in B2B communications by setting up network to network VPN's. Anyone not on the VPN can not reach the servers. Employees can use their corporate VPN to also access the servers.