Client must provide a proof-of-work. There is no standard for that, so the only way is to implement the client-side code in javascript.

It would be great if there was a standard for that so that all kinds of clients knew how to provide a proof of work, e.g. like this:

  WWW-Authenticate: Proof-Of-Work difficulty=5 challenge=XYZ
  Authorization: Proof-Of-Work abc

Where sha256(abcXYZ) would have to start with at least 5 zeros.

I was thinking about adding a link to a page that is hidden in a one pixel image and same color as the page background. hiting it would mean a rule would be added on the firewall to ban that ip for a few weeks.

The only is issue I can think of is there may be browsers or browser extensions that preload links to show thumbnails and users might be banned without knowing why.