Because #5 is a bit annoying for visitors, introduce a level of bot detection.
Idea of levels of protection:
- 0 : Detect if it's a bot after serving the real HTML code with a basic bot technique
- 1 : Detect if it's a bot before serving the real HTML code with a basic bot technique
- 2 : Detect if it's a bot before serving the real HTML code with an advanced technique like browser fingerprinting