Depends how high is your bar for "effective". For example there's nothing secret in rate limiting and IP bans, and these are fundamental techniques. However, t

Depends how high is your bar for "effective". For example there's nothing secret in rate limiting and IP bans, and these are fundamental techniques. However, there are plenty of opportunities to catch spammers when they make stupid mistakes. I've worked with web bot spam. I could catch a very popular bot brand by observing that it sent Accept header with content that was implausible for the User-Agent it sent. If the code was public, spammers could see `if (browser == safari && accept != safari-like) { spam }` and fix their header in minutes. There's also a middle ground where the algorithm is public, but it's powered by secret data: blacklists, databases for classifiers, ML models. From accountability point of view data being secret is as problematic as secret code.