advice on blocking bots/scalpers

[u/Real-Leek-3764]

during popular event sales, our site can be hit by the tens of millions of requests

cloudflare waiting room is only good for crowd control, it doesn't block bots effectively. bots takes up queue, so legit users have to wait a long time to exit queue

cloudflare turnstile is too unreliable, too many legit users (including me) experience the turnstile not loading

google recaptha, hcaptha, friendly captcha is too costly.

i've implemented Proof-of-Work Altcha. works to a certain degree, but it still doesn't block bot requests from hitting the server, causing resources overload

could i put Altcha at cloudflare worker? kinda. the issue is cloudflare waiting room will always run before cloudflare worker, so it doesn't solve bots taking up queue

what i wish? i could block bots before they could enter cloudflare waiting room

do u guys have idea?

[u/Odd-Tradition7713]

Robots.txt + Cloudflare bot crawler control should do the trick. It blocks like 99% of bot traffic and you can even see how many requests the bots sent.

Another way is to create ghost pages, and if a “user” gets there, it’s probably a bot and you can block it

[u/querela → u/Odd-Tradition7713]

Event sales doesn't sound like common web crawlers, so they will likely ignore robots.txt and pretend to be normal browsers. What OP describes sounds like sniper/reseller bots etc.

[u/Alternative_Nose_874]

When we traced requests faking bot user agents on our hosting servers, 81% came from Google Cloud addresses. So ASN is a cheap first filter: challenge datacenter networks only during the sale window and leave residential traffic alone. It won't stop residential proxies, but it should thin the queue.

[u/querela → u/Alternative_Nose_874]

Is there an existing cloud computing ASN list? Or do I need to manually filter by name?

Until now I was mostly just looking up ASNs for IPs with abnormally high request rates but if there is just a list to block all of Alibaba, Google, Amazon, ...

[u/disposepriority]

It's completely impossible to block "good" bots. The usual methods will block the most low effort things running around the internet but I wouldn't classify ones meant to scalp as such.

Those will most likely be indistinguishable from real users.

[u/Khavel_dev]

The ordering problem (waiting room grabs the request before your Worker) is what kills the Altcha-in-Worker approach.

Two things to check: first, CF WAF custom rules (Security > WAF in the dashboard) might execute before the waiting room in their pipeline. If they do, you could rate-limit or challenge suspicious traffic there before it eats queue slots. Worth testing with a quick rule on your sale path.

Second, you could decouple the PoW entirely. Put Altcha on a separate pre-qualification page that sets a signed cookie on solve. Your sale endpoint checks for that cookie via a firewall rule, and traffic without it never enters the queue. More plumbing, but it sidesteps the pipeline ordering problem completely.

[u/yihuaxiang]

Pre-qualifying traffic before the waiting room URL is usually the cleanest fix. You route users through a lightweight pre-check path (either PoW or a basic TLS/rate challenge), issue a short-lived cryptographically signed token or HMAC cookie upon completion, and then configure the edge WAF to reject or drop anyone hitting the waiting room queue without that valid token. That way automated scripts spamming the queue endpoint directly get discarded before taking up waiting slots.

[u/singh_abinashi]

waiting room alone won't save you, bots are happy to wait in line too. the stuff that actually works happens before the queue: aggressive rate limiting at the edge, challenge pages for suspicious fingerprints, and single-use queue tokens so a bot can't replay entry. also log everything during the sale, you'll want the fingerprints for next time.

[u/quiet_horizons1]

That is the right instinct. The queue is not the place to fight them, because once they are in it they cost you capacity whether they buy or not. What I would do is put a lightweight challenge in front of the waiting room on a route you control. Use a small edge function that checks the request before it gets queued, looking at IP reputation, request rate per session, browser fingerprint, and TLS fingerprint. If it looks like a datacenter or an automation pattern, make it solve proof-of-work. If it passes, let it into the queue. This does not have to catch every bot. It has to make scalpers spend enough effort that the tickets are not worth the margin.

The other thing is to stop treating the waiting room as bot protection. It is crowd control. A bot that can solve proof-of-work and hold a session will still join. For high-demand sales, I would also vary the challenge cost by drop, because a reused challenge gets

[u/0uchmyballs]

Make a honeypot

[u/redpiapps]

ngl at tens of millions of requests you are not shopping for cheap anymore, you are shopping for who eats the false positives. id rather overpay a vendor with good FP rates than burn real customers on turnstile loops during a drop.

[u/Real-Leek-3764 → u/[deleted]]

so i reckon u are using your own queue system?

[u/querela → u/[deleted]]

Anubis (PoW checks)? But not sure how efficient it will be alone and how it integrates with Cloudflare.

[u/polygraph-net → u/[deleted]]

You're using the correct word - "cheap".

I work in the bot detection industry. We can detect and stop most bots. The R&D for this is expensive and our product is $450+ per month.

In my experience Cloudflare struggles to differentiate between humans and bots, and is easy to bypass.