Configure Site Anti-Bot Protection

My custom-built site needs a rock-solid anti-bot layer that blocks fake form submissions, automated account sign-ups, and any spam or harmful traffic that tries to hit us. Protection must cover every public surface: contact and other forms, sign-up and login endpoints, plus general browsing traffic. I already have full control of the codebase and server, so you’re free to combine server-side logic (rate-limiting, IP reputation checks, device fingerprinting) with client-side tools such as Google reCAPTCHA v3, hCaptcha, or invisible honeypots. CDN-level shielding through Cloudflare or a comparable WAF is welcome as long as it doesn’t slow the site down. Whatever stack you suggest, please make sure legitimate users never notice extra friction. Acceptance criteria • All targeted pages silently block or challenge non-human requests with <1% false positives. • Legitimate form submits and new-account sign-ups go through in under two seconds. • Clear setup notes and a short README explain how to maintain or extend the defenses. Once the solution is live and passing basic penetration tests, hand over the updated code, config files, and the documentation mentioned above.