Checked incoming traffic with a honeypot checker, what should we do with these risk scores?

You can't deal with bots by just statically blocking IPs because botnets rotate IPs constantly. Set up rate limiting on your web server instead. Temporarily throttle or challenge anyone making more than five requests a second to your cart and search endpoints.

Those free lookup sites are usually way too slow to update their databases. Even a data center IP that was cleaned up three months ago can still show up as malicious. If you just block based on their lists, you'll end up losing real customers connecting from mobile networks.

The quickest fix you can apply right now is to bump up the security level in your DNS dashboard and throw a browser challenge at scrape requests from suspicious countries. Real users get through while simple scrapers get stuck.

The order you should roughly follow is: 1) Look for common user-agent patterns in your server logs. 2) Put a hidden honeypot link on pages search engines shouldn't touch, and ban any IP that hits it for 24 hours. 3) Rate-limit your checkout and cart pages.

we panicked once and blocked like 50 ips, turned out it was the office network of one of our wholesale customers.. and the guys ended up ordering somewhere else because our site wouldn't load static blocking is way too risky.

Last month during a similar scrape we found 3,000 different IPs hitting our server. External tools flagged 1,200 of them as risky, but when we dug in, only 75 were actually scraping data. Acting purely on IP without looking at behavior is just a waste of time.

Are these requests actually maxing out the server CPU, or are they just cluttering up your access logs? Also, do the hits come in during specific time windows, or are they scattered across the whole day?

Generally correct, but one part is missing. Your time to detect an issue directly determines its cost.

Just leaving this note, it might be useful.

This approach has a cost, which isn't discussed. When making decisions, write down the worst-case scenario too, not just the best.

The real issue isn't the number, but what it's based on. Correct me if I'm wrong.

My question might sound amateurish sorry about that. People defend habits not processes. Resistance comes from there.

An automated scan report is not the same as a penetration test. Correct me if I'm wrong.

I completely agree. If you don't write this down from the start, it leads to arguments later.

My questions are cleared up, thanks.

Timely topic. When making decisions, write down the worst-case scenario too, not just the best.

Just leaving this note, it might be useful.

I have no experience with honeypot checker, so I'm asking. The biggest time-waster for us was not knowing who had the final say.

If it's your first time, start small; scaling comes later.

I'd say don't rush. An untested backup is not a backup.

Start with a small trial; don't commit to everything at once. Hope this helps.

Here's how it went for us. If you get three different answers on a topic, the question was asked wrong.

Everything goes well for the first three months; problems arise in the fourth.

I agree with this. If you scold false alarms, nobody will report again.

Hope this helps.

Here's how it went for us. The biggest time-waster for us was not knowing who had the final say.

Of course, it varies if your situation is different.