My personal VPS was recently inundated with 800GB/month of traffic from AI scraper bots. Upon a bit of investigation they were getting stuck in some deep git history pages. I looked into Anubis and the like, but making carveouts for API endpoints seemed complicated.

Luckily the Gitea devs had recently implemented `REQUIRE_SIGNIN_VIEW = expensive` as a fix. It was minimally invasive for regular users, most pages can still be accessed without login, and it completely solved the AI bot problem, my traffic and load averages are back to normal.

Thank you Gitea devs for a great product, happy user for over a decade both personally and professionally.