A simple "WAF" can be implemented without hardware or anything overly complex by doing just a three things that will eliminate most malicious traffic.

• Block all traffic from AWS, Azure, etc. yeah, you'll loose some traffic from some VPNs and maybe you care and if so, this suggestion isn't for you.

• Verify the traffic saying it's GoogleBot, BingBot or DuckBot are really from those sources. All three provide a list of valid IPs accessible via a REST endpoint to match incoming IPs against. Block Yandex etc. There is likely no good for you coming from a Russian or Chinese search engine indexing you.

• Make sure the browser versions in the User Agent aren't like 5 years old. That's a great indicator of a bot.