Deemwar Monads & Abstractions

Your traffic spike may be bots

Source: I posted to HN, and then my website was flooded with AI BOT traffic, by sam

A developer posted a feed reader to Hacker News and the site slowed down. The cause was not the readers. Two counts over the server logs, one per path and one per client, showed it was mostly bots.

a hundred or so upvotes
nearly half traffic from one client
2 counts that found it

How the cause was found

  1. 1

    Post and slow down

    hacker news

    The developer posts sprinklz.io, a feed reader that can push topics down a feed. The post gets a hundred or so upvotes. The site becomes painfully slow.

  2. 2

    Blame the attention

    first guess

    The developer puts the slowness down to a popular post. It continues, and gets worse several days later.

  3. 3

    Read the metrics

    app metrics

    They do not add up: a good handful of active, logged-in users, and a server under very high load.

  4. numbers disagree → the first guess is wrong · go to the logs
  5. 4

    Count requests per path

    endpoint logging

    Most requests never try to fetch an article. The site is a single-page app, so most requests never ran the JavaScript that renders the page.

  6. 5

    Count requests per client

    nginx logs

    Nearly half the traffic comes from one service. It watches sites for changes and summarises them into an AI newsletter, polling many times per minute. It is blocked.

  7. 6

    Sort the rest

    user agents

    Several others are known crawlers that name themselves: Claude bot, OpenAI bot, Google’s search indexer and more. A few vulnerability scanners probe WordPress paths on a site that is not WordPress.

  8. 7

    Fix and harden

    robots.txt · rate limits

    robots.txt now discourages most AI crawlers and allows search crawlers. Rate limits are added. The developer replays the scanner paths to check nothing leaks, then works on making the site faster.

One log, two counts, two different answers.

The two counts

Each count answers a different question. Run both before you blame the launch.

Per pathwhat is asked for
Per clientwho is asking
Known crawlersseveral
One pollernearly half · blocked

What it teaches

SignalLessonRule now
Slow site after a popular postAttention was the wrong suspectCheck load against real users first
Few logged-in users, high loadThe load is not peopleCount requests per path
Most requests skip articles and JSClients are not browsersCount requests per client
One client, nearly half the trafficOne poller can swamp a small siteBlock it; add rate limits

Guardrails

Read the original

I posted to HN, and then my website was flooded with AI bot traffic, by Sammy Straus.

The Hacker News discussion.

Sources: every fact and hedge on this page (“a hundred or so”, “nearly half”, “several”, “most”) comes from the post above. The post gives no exact request counts.