Prevent bad robots.
Easy to implement
13 High impact score
Bad bot traffic is a bigger share of the web than most people assume; industry research puts overall 2021 web traffic at roughly 57.7% human, 14.6% good bots (search crawlers and the like), and 27.7% bad bots. Sophisticated bots are increasingly good at mimicking human behaviour, which makes them harder to filter out with simple rules and every request they make still costs energy and carbon, even though it delivers no value to a real visitor.
DDoS traffic can be a far larger share still, and it varies enormously by region and sector: one industry trend report found that in a recent year, 93% of all network- and transport-layer traffic to Chinese-registered businesses was attack traffic only 7% was legitimate with Lithuania at 87% and Finland at 80%, and 42% of application-layer traffic to Georgia-registered businesses also identified as attack traffic. Blocking this at source, e.g. with a WAF or at the cloud subscription level, removes a significant and entirely wasted compute and network load.
This is particularly important if your website is running ads.