Some advice here:
https://dev.to/mpoiiii/bot-management-keeping-your-website-safe-from-disturbance...Blocking bot access starts with identifying the type of bot access.
Malicious bots can be broadly categorized into the following types:
Identity Masquerading Bots: Designed to bypass security protections and perform malicious actions, such as DDoS attacks, spam posts, and brute-force login attempts.
Content Scraping Bots (for illegal purposes): Illegally scrape website content, leading to intellectual property infringement and data leakage. This includes pirated sites scraping e-books, images, or video content.
Account Hijacking Bots: Use credential stuffing techniques for illegal login attempts to hijack user accounts. These bots leverage leaked usernames and passwords for large-scale login attempts.
Ad Click Bots: Used to click ads to fraudulently increase click-through rates for ad revenue or deplete a competitor's ad budget.
Spy Bots: Designed to gather competitive intelligence, such as website information, pricing, and user data for commercial espionage.
Spam Bots: Automatically send a large volume of spam emails, comments or submit spam through contact forms, affecting user experience and server performance.
Traditional blocking methods include analyzing User-Agent, IP address locations, access behavior (like access frequency and click streams), and device fingerprinting.
and also here:
https://kahunam.com/articles/seo/essential-robots-txt-rules-to-control-bots-on-y...
Forum
Pages: 
