I am trying to write a script that will let me identify bots that are trying to flood my oscommerce site, but some bots change their IPs frequently so I cant really use the IP to ban them.
I was thinking may be if I enable sessions for bots, I could use the session IDs to block the bot.
I did some research on this and found that enabling sessions for bots is not recommended but I am still not sure why?
The problem with allowing bots to have a session is that a malicious bot in some cases won’t maintain a cookie state across the pages that it crawls on your site. So each hit on your site by a bot will generate a new session.