I played with the HTTP/2.0 only protection a while back but had legit users complain that the site wouldn't load (they were running old browsers).
How did you set up LUA scripting to provide a JS hidden browser test with Nginx and HAProxy?
How did you set up LUA scripting to provide a JS hidden browser test with Nginx and HAProxy?
Most of these give site-wide examples but one can run the LUA by locations or other ACL's to protect specific resources or exclude specific resources from protection. e.g. RSS feeds.