@p @cjd I think you could do blocking based on UA for older browsers (like ~2 year old versions) on certain endpoints you would encounter from a browser like: /instance; graphs; search; the stats/hockey stick ones. Anybody that goes there with older browsers or things like curl/wget gets nullrouted for like a day. There isn't a reason to go there without a browser (even something like links/lynx should get whitelisted). And leave only the RSS/Prometheus endpoints wide open.

I think at this point it's better to provide a degraded service then one that barely works at all, if you infra can't keep up currently. Also you are probably already doing that and I just missed it/forgot about it. I guess that's what the awk script does.