Exactly. If someone can harm your website on accident, they can absolutely harm it on purpose. If you feel like you need to do anything at all, I would suggest

Exactly. If someone can harm your website on accident, they can absolutely harm it on purpose. If you feel like you need to do anything at all, I would suggest treating it like any other denial-of-service vulnerability: Fix your server or your application. I can handle 100k clients on a single box, which equates to north of 8 billion daily impressions, and so I am happy to ignore bots and identify them offline in a way that doesn't reveal my methodologies any further than I absolutely have to.