How to protect the site from bots and machines?

Question

Information Security

Hello.
How to protect the site from bots and machines?
Basic protection methods usually do not cope. They only nightmare real people.
For example, captchas during registration (even Google captcha) do not work, there are services that solve captchas for a penny. They are not profitable for a brute, but if someone needs to make several tens of thousands of spam accounts, captcha will not stop him. The same applies to limiting registrations from one IP address, this will only make users nightmare, but will not interfere with the villains.
Also, automated control systems (such as, for example, the mass liking system on the same Instagram). How to protect yourself from them? Set a limit on the maximum number of actions per unit of time - just set a delay and the system works. Blocking access from another device - bypassed, but annoying for real users. Etc.
Are there any advanced protection methods that cannot be bypassed? Or in order to get around them, you need to make so much effort that this is not comparable with the profit.

Answer 1

Button-image "Fill the form" and on click - form generation in JS.
More complicated: Change field names just before submitting data via AJAX.
Or create a behavioral filter.
(otherwise - only captcha)

Answer 2

if bots lead to DOS, then solutions from cloudflare, etc.
if it's just a fight against spam registrations - then fine field validation, honeypot
if they parse you specifically - then you need to look at their bot, fight specifically with it

Answer 3

Block the same type of action that is repeated too often

Answer 4

in practice, both bypassing captcha and delays do not work much,
you could look for
a topic here more for a specific task - Amazon people are trying to parse), at the same time ask - did it finally work out for him?

Answer 5

I tried a lot of things, settled on autoloading the form via ajax (you can do it on click) + filling time control (if the form is sent in less than 10 seconds - do not accept).
It is clear that it will not save you from writing a bot for you, but for now it normally helps from ordinary bots.