After emailing IT to check it's alright try using cloudflare's WAF "bot management" option on staging.
Talk to EM about getting business plan paid for on the cheap tier (the $20 a month one).
Please take notes on:
- how easy it is to configure the rules?
- how it works for different domains (including custom domains)?
- how easy you think it would be to add new hostnames from the platform api via their api?
- the blocking strategies (with particular c.f. to anubis)
- exceptions (how do we unblock legit users?)
- also how does this work for our API traffic?
- do we need the $20 a month or $200 a month plan