News for hackers. Stuff that matters.

A comment on Cloudflare Turnstile requiring fingerprintable WebGL. Parent comment

Re:Cloudflare Turnstile requiring fingerprintable WebGL by dr_um on Sunday May 31, 2026 @04:13PM (#48349303)
A small, single EU country focused non-static e-commerce, with proper robots.txt instructions that worked perfectly well in the search & co bots -only "era" with rate limiting for nginx/php-fpm setup - is kinda struggling without CF to handle 15000 requests per 15 minutes, coming from Chrome "users" from IPv6. Best so far was an avg. server load in htop = 40 on an 8-core server x_x
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by PunchyHamster on Sunday May 31, 2026 @05:33PM (#48349964)
> handle 15000 requests per 15 minutes,

that's just ~17 req/sec

That's "cheap VPS running wordpress" level of traffic

[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by BenjiWiebe on Monday June 01, 2026 @07:41AM (#48355543)
Maybe a plain WordPress install. Run something like WooCommerce and install a bunch of plugins to get the functionality that WordPress and WooCommerce should have built-in, and suddenly a cheap VPS can only handle 2 or 3 requests per second.

It's phenomenal how inefficient the WordPress/WooCommerce stack is.

Though the main issue I'm seeing is credit card testing, not scraping.

And I'm ideologically opposed to using a CDN (because it shouldn't be needed for such a small site!) so it's somewhat a self-inflicted problem...

[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by PunchyHamster on Monday June 01, 2026 @08:16AM (#48355822)
"Security" plugins are also HUGE problem here, most of them turns "few cached DB SELECTs" (or static file read if you use caching plugin) into now a bunch of inserts, just to log/analyze "offender" IP and maybe block it, in many cases turning "blocking offender" to be more costly that would be serving the page without the security plugin
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by canyp on Sunday May 31, 2026 @05:43PM (#48350047)
Block out IPv6 and see if that helps.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by lxgr on Sunday May 31, 2026 @06:16PM (#48350265)
Why not block all odd v4 addresses while you're at it? I heard that that can reduce scraping volume by 50%!
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by ipaddr on Sunday May 31, 2026 @08:34PM (#48351348)
Blocking Singapore reduces the AI load 90%.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by ssl-3 on Sunday May 31, 2026 @08:35PM (#48351352)
That's harder to set up, and also unfair to people who have an odd IP address.

It's easier and better to just block 0.0.0.0/1 half of the time, and 128.0.0.0/1 for the other half of the time. Switch every day at noon.

Bot traffic will be cut by 50%, and humans are all treated equally! It's a total win!

[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by tardedmeme on Monday June 01, 2026 @06:24AM (#48354904)
And blocking ipv6 addresses isn't unfair to people who have an ipv6 address?
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by ssl-3 on Monday June 01, 2026 @02:49PM (#48361011)
Yeah, I suppose you're right.

Just block it all.

[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by redox99 on Sunday May 31, 2026 @06:56PM (#48350567)
That's 16.6rps. A single guy holding the F5 key on chrome can generate that much traffic and take down your website. That kind of performance was never acceptable.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by bschwindHN on Sunday May 31, 2026 @10:00PM (#48351847)
People will always reframe their request numbers to avoid stating their pitiful requests per second numbers, it's hilarious. "This thing is handling hundreds of thousands of requests per day!" Like cool, you're barely making it double digit requests per second.
[ Parent | on HN ]
Re:Cloudflare Turnstile requiring fingerprintable WebGL by codedokode on Sunday May 31, 2026 @11:07PM (#48352199)
You can calculate traffic stats for a day by IPs/subnets and probably bots will stand out. If they are using IPv6 you can figure out the ASN and block it completely.
[ Parent | on HN ]