I cut bot traffic to my site by over 80% with a simple trap. Last month, my hobby website OpenBenches.org transferred more than 2.5TB of data to visitors. As much as I’d like to think the site is enormously popular, it looks like it is just AI bots endlessly crawling the data and slurping up the images. So I’ve built B to be an indiscriminate tool to eradicate these unwanted parasites. It is…
Have you considered using fail2ban instead of .htaccess and PHP?
Like fail2ban crawls your access log, sees a request to /honeypot and adds the IP to its banlist.
I have something similar running, if you try to login in my nextcloud too often you get fail2ban-ed too (instead of nextcloud disabling the user account which inconveniences me). Required forwarding the nextcloud logs to the nginx LXC but that works fine too…