So how do you stop bots from submitting fake data to sign up forms or trying to brute force password fields etc. on websites?

For passwords: offer 2FA (ideally WebAuthn, but it sadly hasn’t landed in enough browsers yet), use a reasonable password strength policy, and possibly consider OAuth login. Or, and I know this is crazy talk, allow users to opt out of the bloody captcha if they say they use a password manager, and then use some basic heuristic requirements on the password.

But stop making me click the friggin’ stop lights every time I log in to my own account.

> brute force password fields

rate limit

> stop bots from submitting fake data to sign up forms

I don't think there's an universal solution here. it depends on the application itself and why you consider fake signups an issue in the first place.

Rate limit by what? Username? IP?

per user if you want to defend against targeted attacks. per IP if you want to prevent untarged attacks. so, both.

add an email-reset for the limit so users can't be locked out of their accounts by a DoS.

Circuit-break after 5-10 failed attempts and require 30s or 1m before each attempt after the first 3 failed ones.

To stop fake signups, require confirming the email address and only allow some number of signups per IP per day. It's not perfect but neither are CAPTCHAs and either way you can probably stop most spam, if it's even a problem for you.