For those who have no resources rate limiting still works better and easier than captchas. You shouldn't do rate limiting per IP though, do rate limiting per /2

For those who have no resources rate limiting still works better and easier than captchas. You shouldn't do rate limiting per IP though, do rate limiting per /24 subnet, /16, /8, /0 per http method per URL, etc. Typically it takes just a few lines of nginx configuration.