I’m getting really tired of “verify you’re not a bot” checks everywhere.
I understand these checks help prevent bots, but they seem to appear on so many websites now. Does anyone else find them frustrating?
I’m getting really tired of “verify you’re not a bot” checks everywhere.
I understand these checks help prevent bots, but they seem to appear on so many websites now. Does anyone else find them frustrating?
No, but only because I’ve helped run a website recently and you underestimate just how much wasted traffic is from scrapper bots. On our limited bandwidth, it was practically a DDOS attack all the time.
https://radar.cloudflare.com/bots
Slowly but surely we’re approaching the point where bots make up the most internet traffic, and additionally because of LLMs more and more of the web’s content is slop, which is why the frontier ai companies are no longer just blanket training on all the internet.
Is there a way to trick the bots into thinking your site was made by an LLM so they won’t want to train on it?
pipe https://man.9front.org/1/bullshit into a recursive html page haha. That might be a fun project actually.
The easiest way would likely be to add an ai written html comment attributing a real ai model and version to the content creation, with a comment that all of the info on the page was ai generated, anecdotal and hadn’t been researched. An ingestion model is then likely to ignore it or rate it low. It should be noted too that all the big ai companies now honor robots.txt and LLMs.txt, so that would more likely be defending against “neolabs” and international labs who ignore them.
My solution reduced 95ish percent of traffic. Bots were hitting my tiny site like mad.
What’s your solution?
Python script with fail2ban. Registers invalid requests then blocks. Works well.
I went from thousands of requests per minute to 10, tops. Bot prevention is a must have.
If bot checks were removed then everyone would be complaining that it’s unusably slow.
It’s easy to block most bots. It’s impossible to block bots that target you specifically. I’m not blocking any bots on my websites, I like it better to optimize performance so that I can serve them all and have a lot of headroom
No, it’s not. Had request from a bot network, always changing ip’s, user agent and request url. There is no pattern there I can block.
I created a bot black hole. Specific recursive link that if the click it three times it blocks the IP. And the link is “click if ai” URL at the bottom. Works like a charm.
No; the traffic i get seems like it had stored my sitemap from ~10 years ago because the requested urls there are long gone, and now tries to guess other url’s with a similar pattern. It does not seem to follow links from the frontpage.
That’s fascinating. It almost sounds like they’re training a scraper. Which, really, is far and away the worst possible bot to have.
Training a scraper? Sounds more like they’re just scraping training data.
I have fail2ban take care if those. 404s and all that.
I already looked into something similar, IP banning does not work. One day i got ~120k unique IPs, but the most active one only made ~100 requests. I would gain nothing if i run any script to lookup the IP with each requests (and using up more resources in the process), if it fails 99% of the time because the next hit is a different IP.
There surely is ja4 but I recognize it requires some setup
I wish Traefik exposed the ja4 fingerprint. There’s an open issue: https://github.com/traefik/traefik/issues/12421