No, block at firewall-level. I never implied you should have to "study", "scan" the attacker's request: drop it. You don't owe net-neutrality to a botnet insta

No, block at firewall-level. I never implied you should have to "study", "scan" the attacker's request: drop it. You don't owe net-neutrality to a botnet instance. That's just for when you should need to be clever, as in when you are tasked to be a sysadmin for, like, an hosting service or a corporate network, so you're not really aware of everything coming and going through. If you're just a self-hoster you should not be clever, neither at ingress nor at egress: you "just" have to minimize attack surface because you probably know what you want to offer, e.g. for a blog you can publish with a SSG or serve HTML pages scraped from a dynamic CMS you'd like to use, like Wordpress, instead of serving the CMS' contents directly (and deal with comments using something else).