Enable reCaptcha for www.lmfdb.org #6129
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
First of all, this is already running on www.lmfdb.org, as I needed to:
This is the solution I have managed to devise so far that doesn't spoil the user interaction and keeps the bots at bay.
If someone has any other suggestions, I'm all ears, but over the last month, we have been observing severe persistence from bots that often lead to www.lmfdb.org going offline.
In particular, we start to notice serious deprecation of service whenever the servers are handling more than 4 requests a second (the blue/green line is the number of accepted/blocked requests):
As you can see, until yesterday (when reCaptcha was enabled), I was not succeeding at keeping the bots under control despite several hours spent tuning firewall rules to try to block bots but not humans.
PS: I still would like to restrict the loading of the captcha javascript to only when we are serving www.lmfdb.org; I will figure that out later.