Post #1570938

@osm_tech FWIW, if the robots attacking you are anything like the ones attacking me (~790k unique IP addresses at peak, about half of them residential), you can mitigate a large majority of them with three ifs in a trenchcoat, implementable in nginx and Caddy, and probably apache and others too. I'm able to mitigate ~60 million requests / day on a €4/month VPS. I had to scale that up once during a larger wave to a €11/month VPS, and that barely blinked when I was hit by a 2.5k request/sec wave that lasted ~4 days. (My bottleneck on the cheaper VPS was TLS, the defense mechanisms I employ are very lightweight.) Happy to help if you need a hand, just give me a shout.