There are a variety of methods that can be deployed: 1) request fingerprinting - browser request headers have arbitrary patterns that depend on user agent. mat

There are a variety of methods that can be deployed: 1) request fingerprinting - browser request headers have arbitrary patterns that depend on user agent. matching user agent strings with a database of the request header fingerprints allows you to filter out anyone who is not using a real browser who hasn't taken the time to correctly spoof the headers. this will filter out low skill low energy scrapers and create higher costs. 2) put javascript in the page that tracks mouse movement and pings back. this forces scrapers to simulate mouse movement in a js execution environment or reverse engineer your ping back script. this is a very high hurdle and once again forces much more computationally intensive scraping and also much more sophisticated engineering effort. 3) do access pattern detection. require valid refer headers. don't allow api access without page access, etc. check that assets from page are loaded. etc. 4) use maxmind database and treat as suspicious any access not from a consumer isp. block access from aws, gcp, azure, and other cloud services offering cheap ip rental.