How Indonesian Businesses Defend Against Bots, Scrapers, and DDoS

Real threats for Indonesian businesses#

1. Credential stuffing — bots use leaked passwords on customer accounts (lots of Indonesian data is leaked on dark-web forums).
2. Price scraping — competitors scrape your e-commerce catalog to undercut prices.
3. API abuse — your public endpoints get hit 100K+ times to drain quotas / drown the database.
4. DDoS — Indonesian ISP filtering is weak in places; 1-10 Gbps attacks are common.
5. Form spam — your contact form floods with 1000+ spam submissions.
6. SEO scraping — your content is ripped and republished elsewhere (Google penalty risk).

Layer 1: Cloudflare free tier#

Cloudflare’s free tier already blocks:

• L3/L4 DDoS (network) — automatic, no config.
• Bot fight mode — flags obvious bot traffic.
• Rate limiting — basic, 1000 req/10s free.
• Bad-bot challenge — auto CAPTCHA for suspicious traffic.

Enable:

1. Domain → Security → Bots → “Bot fight mode” ON
2. Security → DDoS → “I’m under attack” mode when you’re being hit
3. Security → Settings → Security level: “High” for sensitive endpoints

Layer 2: Server-side rate limiting#

Even with Cloudflare filtering, defense in depth: the app server still rate limits. This protects you if attackers bypass Cloudflare (origin-IP attacks).

Caddy / Nginx setup:

# Caddy: 100 req/min per IP
@ratelimit {
  remote_ip 0.0.0.0/0
}
rate_limit @ratelimit 100r/m

For specific APIs, layer it: edge (Cloudflare) + app (Redis token bucket).

Layer 3: WAF rules#

Cloudflare WAF (Pro at $20/month) blocks:

• SQL injection patterns
• XSS payloads
• Path traversal (../etc/passwd)
• Generic OWASP Top 10

Custom rules:

(http.request.uri contains "/wp-admin")  →  Block
(http.user_agent contains "scrapy")       →  Challenge
(ip.geoip.country in {"RU" "CN"} and not user.verified)  →  Challenge

Layer 4: Hide your origin IP#

Make sure your server origin IP doesn’t leak. Common leaks:

1. Email server on the same domain → SPF/DKIM records expose IP. Use separate mail forwarding.
2. DNS history from before Cloudflare. Consider rotating the server IP after enabling proxy.
3. Non-proxied subdomain → leaks IP. Make sure ALL subdomains are proxied.

If attackers learn your origin IP, they’ll bypass Cloudflare directly. Harden the server firewall to allow only Cloudflare ranges:

# /etc/iptables/rules.v4
-A INPUT -p tcp --dport 443 -s 173.245.48.0/20 -j ACCEPT
-A INPUT -p tcp --dport 443 -s 103.21.244.0/22 -j ACCEPT
# ... full Cloudflare range
-A INPUT -p tcp --dport 443 -j DROP

Layer 5: Form anti-spam#

1. Honeypot — a hidden input bots fill but real users don’t. Block submissions that fill it.
2. hCaptcha or Cloudflare Turnstile for sensitive forms.
3. Server-side validation — email format, message length, suspicious patterns.

Layer 6: Content protection#

If your content is being scraped:

1. DMCA takedown to Google (most effective, 24-48hrs delisted).
2. Cloudflare Bot Management Pro to block known scrapers.
3. Watermark content with unique phrases that Google indexes → trace re-publishes.

Often forgotten#

• Update plugins & frameworks — most breaches go through known CVEs in old plugins.
• Strong passwords + 2FA for admin panels.
• Audit logs — track every admin login + config change.
• Test backup recovery — a backup you’ve never restored isn’t a backup.

Our standard security stack#

For production clients:

• Cloudflare Pro ($20/month) — WAF, bot mgmt, advanced rate limit
• Sentry for anomaly detection
• Fail2ban on the origin
• Daily backups with restic
• Monthly patching cycle

Total: ~$50/month for multi-layer defense.

Free security audit — we’ll scan your site and return a concrete report.