FAQ: Q1. But bots could crawl my site and scrape my content! They can just buy a new IP (but they usually won't need to since they can just emulate a web brow

FAQ: Q1. But bots could crawl my site and scrape my content! They can just buy a new IP (but they usually won't need to since they can just emulate a web browser or use Selenium and this bypasses the "block", are you paying attention?) Q2. But my website could get hacked by a malicious web request! They can just fill out the captcha and then hack your website. Or change IP if the captcha wasn't an option (but it is in 99.99% of cases in my experience) Q3. But this is needed to stop DDoS! To stop DDoS you temporarily block the most taxing IPs at the IP level. You don't generation a web session, a session to a 3rd party captcha provider (who then has to generate all the same and an image) and then see offer the bot a second chance. In other words: this has nothing to do with DDoS. Q4. It doesn't have to be perfect, it's just one layer of defense! This is an ad hoc hypothesis. If you don't know what that means go look it up. You would not be arguing this if they did not create this policy. And there was no difference of the security of the web at large before and after this.