# Progress: Squashing and Redirecting Rouge Bots

**URL:** <https://community.unix.com/t/progress-squashing-and-redirecting-rouge-bots/396753>\
**Category:** Web Development\
**Created:** [March 25, 2025, 10:28am UTC](https://community.unix.com/t/progress-squashing-and-redirecting-rouge-bots/396753 "2025-03-25T10:28:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neo](https://community.unix.com/user_avatar/community.unix.com/neo/32/22838_2.png) [@Neo](https://community.unix.com/u/Neo)\
**Post date:** [March 25, 2025, 10:28am UTC](https://community.unix.com/t/progress-squashing-and-redirecting-rouge-bots/396753/1 "2025-03-25T10:28:05Z")

</div>

**Well, _Hell Yes!_ 🔥**

Just a few weeks ago, this Discourse site was getting slammed with around **4 million rogue bot hits per day** :

 ![Screenshot 2025-03-25 at 5.14.38 PM](https://community.unix.com/uploads/default/original/3X/6/f/6f7740c3c2411b082dbb33ae325fdb169e60417b.png)

Now we’re down to about **10% of that** —hovering in the **300K range daily** :

 ![Screenshot 2025-03-25 at 5.14.57 PM](https://community.unix.com/uploads/default/original/3X/7/8/782399f5071ad0c490218c67b59238be930b0d69.png)

I wrote a decent chunk of PHP using a `switch (true)` filter pattern:

```php
switch (true) {
    case:
    case:
    case:
    default:
}

```

This routing logic is pretty expansive—filtering and redirecting based on load averages and URI patterns.

For junk bot queries that hammer the CPU, I extract a keyword and redirect them to a Google site search—huge relief on server load.

The code is private on GitHub for now, but might go public someday. With Skippy’s help and a hell of a lot of work, the beast is officially **tamed** :

 ![Screenshot 2025-03-25 at 5.23.09 PM](https://community.unix.com/uploads/default/original/3X/7/7/77622e50cba4f97e040922cfb991d0f1bdf89a7b.jpeg)

**55 commits later** , we’re filtering and redirecting legacy bot traffic from the endless barrage—efficiently and aggressively:

 ![Screenshot 2025-03-25 at 5.25.15 PM](https://community.unix.com/uploads/default/original/3X/4/9/49dbb4cc83543435c2563af646b8fb6723a64d2a.png)

* * *

## See Also

[https://community.unix.com/t/recent-unix-com-site-changes-github-commits/396701](https://community.unix.com/t/recent-unix-com-site-changes-github-commits/396701)

## Honorable Mentions

- `fail2ban`
- `iptables`
- `apache.conf`
- `git`
- `mosh`
- `screen`
- Skippy the Magnificent

## Favorite Algorithm Module

My favorite part of the code is the dynamic redirection logic based on the **1-minute load average**.

- When the load average is _below_ a set threshold (e.g., `2.0`), low-value URIs are routed to the Discourse app as normal.
- When the load hits or exceeds the threshold, that same traffic is **diverted to a Google site search for `unix.com`** , taking pressure off the server in real time.

It's simple, adaptive, and brutally effective.

Honestly, most of the bot traffic is pure garbage—I could easily blackhole the majority of it. But I’m making an effort to **preserve as many legacy URIs as possible** and **avoid blackholing unless absolutely necessary**.

---

<div class="post-metadata">

**Author:** ![system](https://community.unix.com/uploads/default/original/2X/c/c7e9e16a595259edafe88615719d5c5dcda035c2.png) [@system](https://community.unix.com/u/system)\
**Post date:** [April 1, 2025, 10:28am UTC](https://community.unix.com/t/progress-squashing-and-redirecting-rouge-bots/396753/2 "2025-04-01T10:28:30Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.