Yes, there are numerous automated and human-powered nuisance traffic streams. 1. CMS sites are constant maintenance, as most are an endless supply of issues. H

Yes, there are numerous automated and human-powered nuisance traffic streams. 1. CMS sites are constant maintenance, as most are an endless supply of issues. However, some have content caching to reduce the SQL workload. 2. Delayed registration with CAPTCHA and a brief explanation of why you are there. Quiet banning IP filter applied to list to boot pending users who enter emails that bonce or fail to authenticate. 3. Firewall blacklist areas of the world where you don't do business (better yet, whitelist the ISPs in the regions you do business), blacklist proxy/tor/spam IP ranges, add port tripwires, and setup rate limited traffic per IP (see slow loris mitigation methods if you are not using nginx). 4. add peer site content blocker for forum spammers/bots i.e. share exploit probes preemptively with the rest of the net. 5. add email filter for mention of bitcoin/BTC, and black-hole the entire IP block if in an irrelevant region. 6. lookup same-origin enforcement for your web-server, add Subresource Integrity Hash to your core, and re-scale/watermark/scrub all media to protect users from themselves. 7. fail2ban rules for common site security scanners, known exploit attempts, and common email scams. You owe nonpaying users nothing, so the collateral cost of blanket bans is $0 in hostile regions. Remote traffic monitoring is also recommended if you have a game engine running. On day 2 we can look at how BTC tumblers/launderers fund most of these issues, and whether it is OK to also preemptively blanket-ban most cloud/hosting providers (costs under 7% of your users in most cases). Remember, adversaries will often pretend to be from wherever they wish to inflict harm, and time does not have an associated cost in the 3rd world. Have a gloriously wonderful day =)