Depends on the small business obviously. I've been in IT for 40+ years and enjoy torturing clankers; I ran a bot motel 20 years ago. These things are so badly written, and obviously they don't care because they're not truly conscious, but the meat in charge is ignorant or doesn't care. So web scraping, and the point cloud of nearly indistiguishable abuse it travels with, is pretty easily tripped by some simple technical tests and salting of content. At least mostly.[0]

I've been wondering to myself "how can I get people to go through a login process without going through a login process?" for a few months, and I've come up with a simple solution which I'll be implementing in the next few weeks.[1] Like the other technical measures it doesn't identify bots but there will be a gate with backpressure that at a point in time a given IP address has some probability (adjusted in realtime based on $things) of passing through, and through my mysterious process is then "logged in". Then that address is pretty much given a free pass as long as its behavior remains "human". Real humans may be denied access initially and have to try again, and their luck will be affected by how aggressively the bots are fighting it out at that point in time. This isn't much different than the extant reality, but it is in terms of what happens after an initial successful page load. It's an experiment, I'm hoping it's tunable so that the experience is more or less indistinguishable from the status quo; we will see.

I'd love to find a group of likeminded individuals where we can discuss some of this TLP:YELLOW or Chatham House Rules. If you are savvy enough to hunt me down and can demonstrate that you're a real human, small operator, and that you can keep things closely held I'll talk with you, if you want someone to run your mitigations that would cost money.

[0] Had an episode last week where somebody scanned approximately 1000 URLs (maybe 60% of the discoverable URLs) over six hours. 1200 addresses fetched exactly one URL, another 400 or so fetched two or three. Every one of those URLs was fetched exactly two times. Real showshoe stuff, nicely done.

[1] Firewall rules and fail2ban. I give fail2ban special powers in terms of the logs it follows and the actions it can invoke. Conntrack without conntrack (of course the firewall has conntrack, it's just not the best option for this use case).