Kong: bot-detection and request-termination are the blunt instruments

curl -X POST http://localhost:8001/routes/api/plugins \
  --data name=bot-detection \
  --data 'config.deny[]=(C|c)url'

# take a route offline with a real message
curl -X POST http://localhost:8001/routes/api/plugins \
  --data name=request-termination \
  --data config.status_code=503 \
  --data config.message='Scheduled maintenance until 02:00 UTC'

bot-detection:       403 {"message":"Forbidden"}
request-termination: 503 {"message":"Scheduled maintenance until 02:00 UTC"}

# request-termination runs at a very low priority, so auth and rate limiting
# still execute first. Attach it to a Route to take one endpoint offline
# without stopping the gateway.
#
# bot-detection matches a header a client controls. It stops lazy scrapers
# and nothing more - do not mistake it for security.