Detecting and preventing scraping of your own site.
Every layer of scraping protection in practice: rate limits, account gating, CAPTCHAs, JavaScript challenges, TLS fingerprinting, behavioural scoring, honeypots, crawler verification, bot-management platforms, watermarking and the legal layer. Each with its documented bypass and its current cost to the attacker.
Anti-scraping plugins for WordPress reviewed against the plugin directory and vendor documentation in August 2026: what each one does to a scraper, where it stops working, and the four addresses that expose your content by default.
What anti-bot systems actually measure, layer by layer: address reputation, JA4 TLS fingerprints, header order, canvas and WebGL, automation tells and behavioural scoring. With platform and solver prices read from vendor pages on 10 August 2026, and the tells that stopped working.
How to tell whether your site is being scraped: the log fields that make the question answerable, which signals survive proxy rotation, how to verify a client claiming to be Googlebot, and what each layer costs. Checked against vendor and standards documentation in August 2026.
Distil Networks is now Imperva Advanced Bot Protection and Imperva is now Thales. How the detection works in 2026, which rivals publish prices, what bypassing this tier costs per 1,000 requests, and where the defence stops.
Every major anti-scraping defence and its documented counter, rechecked in August 2026 against vendor pricing pages, specs and repositories. Includes our own TLS handshake measurements, current proxy and solver prices per 1,000, and three claims that circulate widely and are wrong.
What to do once your site is being scraped: nginx rate limits that do not accidentally deindex you, edge filtering by plan, JavaScript challenges, image obfuscation measured against OCR, and takedowns, with both sides priced from vendor documentation on 13 August 2026.
Cloudflare Scrape Shield in August 2026 is two toggles, not five: email obfuscation and hotlink protection. Server-side Excludes was deprecated on 14 June 2024, the threat-score dial in March 2025, and the 2012 content beacons went away without a notice.
How SQL injection works and how to stop it, retested in August 2026: the probe, OR 1=1, UNION and blind variants against live databases, why parameterized queries are the primary fix, and where binding stops protecting you.