July 26, 2026
Botched by the bot blockers?
How to Block Some of the Bots
Website owner declares war on bots — commenters say real humans will be the first casualties
TLDR: The article offers do-it-yourself ways to block bad bots from visiting a website, but readers immediately argued the methods could also lock out normal people. The comments split between loving the chaos, mocking the risks, and saying smarter attackers would dodge these tricks anyway.
A scrappy guide on blocking bots without paying for a big protection service has turned into a full-on comment-section cage match. The post lays out a menu of tricks for keeping out junk traffic — from refusing older ways of connecting to a site, to blocking data-center visitors, to setting traps for shady scanners. The author’s vibe is basically: use at your own risk, don’t blame me if you block your aunt, your boss, or your dignity.
And wow, the crowd had thoughts. The loudest reaction? This will absolutely hit real people too. One commenter flatly warned that “most (all?)” of these tricks would block valid visitors, while another delivered the spiciest moral judgment of the thread: people who block tools like curl and wget belong in a “special place in hell,” especially when users just want to download files from a server. Translation for non-tech folks: some readers think this anti-bot plan could punish normal users just trying to access a site in practical ways.
But the thread wasn’t all doom. One of the funniest replies loved the idea of planting a fake admin address so amateur attackers end up accidentally scanning their own hosting company and maybe getting themselves banned — pure internet slapstick. Another commenter rolled in with the cold-water take: the attackers they see are already using fake disguises and changing fingerprints, so many of these defenses could be beaten in under an hour. In other words, the real drama is whether this is clever DIY security… or an elaborate self-own.
Key Points
- •The article is a draft guide describing optional methods to block some web bots without using a CDN.
- •It warns that these methods can cause false positives, may block legitimate users or services, and are not recommended for revenue-generating environments.
- •The table of contents lists nine methods, including HTTP protocol filtering, data-center blocking, client-signal checks, NFTables, fingerprint detection, and Brotli-based tactics.
- •The detailed section provided is Method 1, which filters traffic based on HTTP protocol version.
- •Method 1 says many bots use HTTP/1.1 while real browsers use HTTP/2.0, and provides NGinx rules to redirect, deny, respond to, or drop non-HTTP/2.0 requests.