I've found that the most effective way to secure a webserver is to just block any IP that pounds on the default vhost by IP. No WAF, no fuss. After a few month

I've found that the most effective way to secure a webserver is to just block any IP that pounds on the default vhost by IP. No WAF, no fuss. After a few months of building up a denylist, I get almost zero hits from scanners and spambots. https://gist.github.com/noahbailey/474922b752ee733d639c91e271992507#file-blocklist_nginx-sh https://gist.github.com/noahbailey/474922b752ee733d639c91e27... https://nbailey.ca/post/block-scanners/ https://nbailey.ca/post/block-scanners/