Einstein said if he had 60mins to solve a problem he spent 55mins understanding the problem and 5mins on a solution. So that's what I do: identify websites affected, observe attack patterns and mitigate. In my experience I mostly see crawlers searching for environment secrets. WAF and cache rules help but doesn't really solve it. Best I can do right now it seems is make sure I'm managing as few sites as possible, make sure they are optimized as possible with smallest attack surface as possible. That means WAF, antibot, cache, etc but also no node modules or bloated frameworks that could potentially be hijacked or could run up the CPU usage. Also avoiding HTTP requests and using worker bindings as much as possible. Also making sure html, css and js in production is compressed as possible. Honestly tho it's the most annoying part of the job but it does sharpen one's skills that's for sure. Been meaning to ask how others are dealing with it.