Configure Site Anti-Bot Protection

My custom-built site needs a rock-solid anti-bot layer that blocks fake form submissions, automated account sign-ups, and any spam or harmful traffic that tries to hit us. Protection must cover every public surface: contact and other forms, sign-up and login endpoints, plus general browsing traffic.

I already have full control of the codebase and server, so you’re free to combine server-side logic (rate-limiting, IP reputation checks, device fingerprinting) with client-side tools such as Google reCAPTCHA v3, hCaptcha, or invisible honeypots. CDN-level shielding through Cloudflare or a comparable WAF is welcome as long as it doesn’t slow the site down. Whatever stack you suggest, please make sure legitimate users never notice extra friction.

Acceptance criteria
• All targeted pages silently block or challenge non-human requests with