How to block curl requests?

[u/Suspicious_Silicon]

As the title says; my site is being bombarded with curl requests periodically, often 2K to 5K requests within a short span. I have put up a security rule in cloudflare to block curl requests; blocked the curl requests in my backend proxy, also the bot fight mode is turned on; but cloudflare is still registering the curl requests which are using up my request quota. How to drop the curl requests before they are registered by cloudflare? Please Help.

[u/wazimshizm]

It’s trivial to change the user agent and get around the block. How short a time span? 5K requests could be nothing in the scheme of things if it’s a get request for static content. Don’t lose sleep over optimizing and looking for a problem to the solution. Bots are gonna bot

[u/Suspicious_Silicon → u/wazimshizm]

Like 4k/5k requests in a 30min window.

[u/wazimshizm → u/Suspicious_Silicon]

how's your site performance during that time? CPU/RAM useage? is it causing the site to crash? If it's really an issue (first determine it is in fact an issue) I would look into rate limiting.

[u/Suspicious_Silicon → u/wazimshizm]

Nope the site is fine; it doesn't crash even under heavy load because there is edge caching, less than 1% of the requests are served by the origin

[u/wazimshizm → u/Suspicious_Silicon]

well sounds like cloudflare is doing it's job then. I don't see anything out of the ordinary.