> 4. If a client is a bot, respond with higher latencies in the xx seconds range. Try to configure your webserver for use of QUIC (UDP) so that you are not DDoSing yourself.

Do bots even use QUIC? Either way, holding tcp state instead of udp state shouldn't be a big difference in 2024, unless you're approaching millions of connections.