Wednesday, September 30th, 2026
For the past couple of months PromptBase has been under attack.
It started in July when I opened my analytics and saw 1,000 people had visited PromptBase in the past 30 minutes, massively up from the usual 200-300.
Pretty cool! (I thought) - the next few times I checked it was 1,000+ again too!
Wow - this is great for the site!
After a week of high numbers, I noticed sales had not moved much, even though that number was now at 2,000+.
I dug in deeper - all these new users were from Singapore, they were on the site for a second, visited one random prompt listing, and then they bounced
Not good.
PromptBase has 500k+ pages now, so it often attracts web crawlers and scrapers.
I'm used to it, and over the years I had built a system to let good bots through (e.g. GoogleBot), and keep bad ones out - e.g. someone hammering my servers to scrape prompts like whatever the heck this was.
I was confused as to why this wasn't working - but I was so busy in San Francisco with Zoneless, I didn't have time to investigate fully.
Fast forward to last week, I finally looked deeper under the hood.
Boy was it bad.
This was some industrial level scraping - thousands upon thousands of IPs - residential proxies; disguised to make it look like normal people.
I tried improving my home-rolled defenses, but the requests were coming from all over the world, and each IP was used once - so it was impossible.
I had to do what I knew I should have done ages ago - migrate to Cloudflare.
I'd put this off because
a) I didn't want that annoying Cloudflare check to ruin UX for real users - and
b), it involved switching DNS servers for promptbase.com - which is scary! It could genuinely break the site.
After forking out $250/mo, and with some AI assistance, I set it up - and gradually I saw my analytics and server usage return to normal.
This was extremely satisfying - however, whoever was attacking still found some workarounds.
More tweaks and block rules seemed to stop it - but I could see whoever was behind it did not stop attacking - in the past 24 hours about 2 million+ requests were blocked/challenged by Cloudflare.
It's pretty scary - I was waking up at 3am to check everything was holding.
At the same time - it was really fun and addictive to try and stop - kind of like a weird PvP video game against some stranger on the other side of the world.
I really really hope I've won for now, and they don't want a round 2.
