I personally have a access_by_lua script that counts accesses per ip and applies a (very generous) rate limit 
If the limit is reached the user will just be presented with a page explaining you hit a rate limit and a button that runs some javascript to verify you&#x27;re not a bot which in turn whitelists the user
This strategy has worked really well so far - havent been a target of too bad things yet though.
Its a very good and cheap way to go for smaller sites though