We have a website and for which we have backend APIs. Now the issue is majority of our APIs are opened for non-logged in user(Functional Requirement).

Now what we want is to secure those APIs in terms that no one you should start crawling and get all the data. One obvious way is definitely bot detector. What are the other standard ways of doing this.

1 Answer 1


You could use:

  • IP denylist/allowlist (by country for example or block all IP from common cloud providers such as GCP, AWS etc).
  • Rate limiting based on IP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .