I just wanted to mention that I finally installed Anubis in front of my Composr v10 site last week, and so far, it's working absolutely phenomenally at blocking these bot requests (and keeping my server online). I've gone from 150-200 active users at any given time to less than 10. Additionally, it appears at least Google and Apple bot requests are still making it through to my website, which was a concern keeping me from using Anubis for a while (and I might tune for additional "friendly" indexers in the future).

I think the optimization these botnets are forcing in Composr might actually be a good thing in the long-term. But short-term, I wanted to offer that as another mitigation option to look into in addition to Cloudflare. Lots of other FLOSS development communities are using Anubis at this point in time (although more for their source code repos/issue trackers/etc, and not necessarily for just their homepages).

I've heard of Anubis. However, I'm stretched very thin for Composr, considering my lack of time and finances. Therefore, I have to cut corners and only do things when absolutely necessary.

I'd rather not invest my time in Anubis right now. The issue isn't the traffic. It's the statistics addon. I'm disabling the statistics Cron on Composr.app when I don't need it to run. The site works fine when the statistics Cron is not trying to process many thousands of records every 15 minutes. However, I have to remember to disable it. LOL. I've been forgetting. And that is why the site often randomly runs slowly.

I've been slowly working on this for several months. I'm figuring out the most optimal way to store and retrieve statistical data in the database when there are potentially millions of records per month. I still haven't found a solution that meets my standards. I don't know if I will. But I'll keep trying to the extent that I can. Unfortunately, there are some things that might just end up broken/disabled or removed from Composr (such as statistics) if I exhaust every possible thing that I can do. One developer can only do so much.