Bot Protection

Layer one is Cloudflare Turnstile, embedded on every public POST endpoint that accepts unauthenticated input. The widget is invisible 95 percent of the time (challenge appears only on suspicious traffic), is GDPR-friendly (no cookie set), and the server validates the Turnstile token with a 5 second timeout. The validator is fail-open: if Cloudflare is unreachable within the timeout the request proceeds, so a Cloudflare outage cannot take the platform down — the other three layers absorb the risk.

Layer two is the honeypot field: a hidden HTML form field that human users never see (and therefore never fill), but naive bots fill in by default. Server-side validation rejects with 422 if the honeypot value is non-empty, which catches the simplest scrapers before they consume any business logic. Layer three is the rate-limit stack: an IP-based counter in Redis per endpoint with dynamic thresholds tuned to endpoint sensitivity (newsletter sign-up tolerates many requests per minute, club application is throttled hard).

Exceeding the threshold returns 429 with retry-after. Layer four is observability: every Turnstile failure, honeypot trigger and rate-limit block writes a structured log entry, increments a Prometheus counter and feeds an alert that fires on a spike (more than ten times the rolling baseline). The alert flows through the platform-operations alerting channel so the on-call operator knows when bot traffic is out of pattern.

Only POST endpoints are protected — GETs are public by design — and the protection is wired through middleware so individual endpoint authors do not have to remember to apply it.