I am reading abpit the attack amd defense strategies of web spiders. Assume I have sensitive information on my website, which should be protected from 3rd party web spiders.
Use case #1:
Me: I set the sensitive data only visible to registered user account. Tourist accounts cannot see them, and hence cannot crawl.
Attacker: Register an account, use the cookie to auto crawl.
Use case #2:
Me: I find the suspicious behavior (e.g., download page > some threshold) of the account in use case #1, and limit the privilege of that account.
Attacker: Register (or buy) multiple accounts, use multiple accounts to crawl from in a distributed and automatic way, so individual account looks less suspicious.
In both use cases, are the attacker's method practical?
What are the important tips to prevent these two attacks?