What's wrong with my comment? Quite literally: Cloudflare has been adopted by 50% or whatever of the web and they run a rudimentary WAF type product that is IP block happy. This is a recipe to get every VPN and Tor node in the world blocked.

What confuses me is that in 2010 all devs were finally on the "don't block stuff based on regex" train, and now all a sudden nothing matters just Cloudflare is God with some handwavy explanation of how they "did a risk analysis".