Live data from Hacker News

A year of fighting scrapers on my 1.5 million-page website

patronview.com

181–190 of 450 posts

Re: A year of fighting scrapers on my 1.5 million-page website

#181
post #101

The worrying thing here is that so many people accepted outsourcing the decision on who can see their website to a large company (Cloudflare). If the company decides that a certain user should not see the website, the user will not see the website, and no one will know about it, and the user will have no recourse. That is not the open web that I would like to see. A second side effect of a knee-jerk reaction to bots…

> If I run a local script or an LLM that needs to fetch a web page from your site and you block that script or LLM as being a bot, you hurt me, the user

You are mistaking yourself, well your bot, as his target audience.

You might as well say “If I want to send you my commercial email, and you block it, you hurt me, the email user.”.

While your point of being concerned about cloudflair becoming a global arbiter of who gets in and who does not (which may at times not just mean blocking bots, intentionally or through technical issues), the need to block the deluge of bot traffic is very real for many sites and that is one of the easy options for them to deal with that. There are other methods like directives in robots.txt and nofollow attributes on links, but so many bots simply ignore those that they are not really useful.

> Bot traffic is not necessarily bad.

Nor is it necessarily wanted. In fact, it often isn't. Unfortunately practically all bot runners seem to either assume that their traffic is the special good kind or not care either way.

> I wanted the information and I have no way of getting at it without investing my own time and effort in going to your website.

I WANT! I WANT!! I WANT!!!

Well, that site runner wants you to access the site as a human, if at all, not via bots. Sorry to be the one to break it to you, but what you want isn't always the most important factor for the rest of us.

> but the real problem is that the website is poorly built and should be improved anyway

Firstly: just no.

Secondly: if you and your bot don't like our badly built sites, feel free to go get your information from those that you consider to be better built. Problem solved.

Re: A year of fighting scrapers on my 1.5 million-page website

#182

Anubis[1] is a superb fix for sites not behind Cloudflare/Fastly/Bunny etc. We had millions of bot requests, on a site serving all countries so we couldn't block by country, with fake user-agents so we couldn't block using that. It uses 'proof of work' to detect real browser software. [1] https://anubis.techaro.lol/

I wish they'd ease up on the whole "don't change the logo without paying us" thing. The furry anime character is a turnoff for anyone with a brand or personal image that doesn't mesh with those subcultures.

It's open source, just ask your AI agent to change the logo.

Re: A year of fighting scrapers on my 1.5 million-page website

#183
post #118

Can someone help me understand the underlying motivation behind this? It makes sense that some crawlers, in the style of Google, would want to index the entire internet. But what is the point of the same crawler re-fetching a page they already fetched an hour ago? Or possibly all this traffic is just independent entities, each trying to cache the internet? The scale of bot traffic makes this seem unlikely. What's the…

Similarly, I've never understood the economics behind the constant rescraping that is flooding the internet or really what's triggering it.

It can't all be agents reacting to user queries. It's confounding how much CPU and bandwidth is getting flushed down the drain.

Re: A year of fighting scrapers on my 1.5 million-page website

#184
post #117

Earlier quoted context omitted.

> If I run a local script or an LLM that needs to fetch a web page from your site and you block that script or LLM as being a bot, you hurt me, the user. No; in this case you are not a user, you are a bot user.

What if I’m a web alerts company? I crawl your content but my clients are all end users who actually see your content at your site.

[deleted]

Re: A year of fighting scrapers on my 1.5 million-page website

#185
post #138

Earlier quoted context omitted.

The best way to read the information on the internet today is via a LLM. Just like you don't process raw data in a data warehouse or datalake by looking at tables, you use a SQL or BI tool, to process all the information on the internet you need to tool to digest it for you. For many, today that tool is a LLM chat interface or agent.

This is such a grim thing to read.

Well agreed, but it's not new, the web has been actively made user hostile by every website owner and their "273 partners".

Re: A year of fighting scrapers on my 1.5 million-page website

#186
post #138

Earlier quoted context omitted.

The best way to read the information on the internet today is via a LLM. Just like you don't process raw data in a data warehouse or datalake by looking at tables, you use a SQL or BI tool, to process all the information on the internet you need to tool to digest it for you. For many, today that tool is a LLM chat interface or agent.

This is such a grim thing to read.

[deleted]

Re: A year of fighting scrapers on my 1.5 million-page website

#187
I just checked Cloudflare for SignalBloom (https://www.signalbloom.ai, which I own and operate).

Over the last 72 hours, Claude-searchbot [1] alone fetched ~205,000 pages. Sent exactly 1 referral. There is a lot of free financial data on the site, hoping for real users to benefit from it. It is hard to not feel a little cheated out that Claude gets to claim "Found it!" to its users without me getting no credits or compensation whatsoever.

[1] Exact user agent `Claude-SearchBot/1.0; +searchbot@anthropic.com)`

Proof: https://i.postimg.cc/Pqc3SS8T/Screenshot-2026-08-07-at-5-33-...

Re: A year of fighting scrapers on my 1.5 million-page website

#188
post #117

Earlier quoted context omitted.

> If I run a local script or an LLM that needs to fetch a web page from your site and you block that script or LLM as being a bot, you hurt me, the user. No; in this case you are not a user, you are a bot user.

What if I’m a web alerts company? I crawl your content but my clients are all end users who actually see your content at your site.

Fetch my RSS then.

Re: A year of fighting scrapers on my 1.5 million-page website

#189
post #9

Is there any cheap way to run personal websites without getting cooked by bots these days, degrading the performance? A $5/month VPS won't cut it anymore.

GitHub Pages, GitLab Pages, and Cloudflare Pages are all free. If you have a static site, you don't need to worry about lock-in, since your files are easily portable to a different provider.

I made this tool to try and make it easier for beginners to get something up on the public web for free: https://weejur.com

Re: A year of fighting scrapers on my 1.5 million-page website

#190
post #86

Earlier quoted context omitted.

It is not absolutely useless, empirically, which you'd discover if you had a website getting hammered by bots and experimented with anubis as a countermeasure. While dedicated scrapers/attackers could work around it, and they could do so much more efficiently than the client-side js, almost none of them do. Unless you like paying additional hosting resource fees to serve bots, it's a worthwhile option, and is less an…

It does not even require the PoW thing Anubis does. I've setup a simple logic that just: Checks for existence of a specific static cookie, if it does not exist, output a small page that sets the cookie via JS and reloads. Sadly this kills Noscript, but it would be possible to add a form in that when submitted sets the cookie serverside. Is this trivial to bypass? Yes. It still keeps out 95% of unwanted bots. Reality…

That's not far from what anubis does for clients that are determined to have light souls. It doesn't always send a PoW challenge.

For a webapp that sets a long-lived cookie, that cookie could be used to bypass anubis completely, or lower the weight in anubis so that it doesn't send its pow challenge unless there are major red flags. If bots start to abuse that exception, it can be removed.

Post reply on HN