Off-topic, but I was thinking that maybe it would be possible to make a bot detection that would run in the browser.
For example, if the visitor didn't move its mouse mouse or never clicks or touches anything after the page is loaded, then it is a bot, perhaps?
This would work for scraper bots that use PhantomJS.
That would work for a percentage of bots. That method is used in the ad fraud detection world, but a lot of the bots simulate mouse moves and other user activities now. There are other ways to whitelist visitors, however.