we use mod_evasive + cloudflare , apache mod evasive is generally effective , we have a static html page which merely says OK for all 403 errors which mod_evasive generates --> this prevents our server resources from being used up to large extent. plus we add abuse IP to cloudflare javascript challenge