@ubernaut cloudflare is comprehensive, IIRC you can toggle it so any new IP needs to do a captcha style challenge first. If we get attacked for real, then setting up cloudflare would likely be the only thing to restore the forum. OTOH, our data is what most people really want, I doubt very many really want to simply DDOS TripleA

@ubernaut I feel like setting up cloudflare probably is on the todo list though..

Free Plan $0 / month Includes Bot Fight Mode (detects and challenges simple bots) and the ability to completely turn on the Block AI Scrapers toggle.

Looks like the setup is not that bad too.

@LaFayette gotcha yeah they are mostly for high bandwidth type issues

@ubernaut We're not.

A) a number of the tunings we applied were needed anyway. They were recommended by the NodeBB people in a "scaling guide" and should have those in.

B) Going through cloudflare at this juncture is extra effort. One time largely, but we have something that works.

C) Likely would not have helped too much actually. The scraper used a bogus user agent and did not declare itself as a scraper. They were sending us about 2 requests per IP per minute. Individually, it was a tiny amount of traffic per IP.

(C) is a bit nuanced. Out of the box there is little for cloudflare to do on this one. There's some toggles I'm aware of though where you can have it help you defend against excess load. In that case, there could be help. But again, there's some tunings we should have had applied already.