rules:
  - name: "Block Known Bots"
    condition: "http.user_agent contains 'bot' or http.user_agent contains 'crawler'"
    action: "block"
    
  - name: "Rate Limit Aggressive Crawlers"
    condition: "rate(5m) > 100"
    action: "challenge"
    
  - name: "Allow Search Engine Bots"
    condition: "http.user_agent contains 'Googlebot' or http.user_agent contains 'Bingbot'"
    action: "allow"
                    

server {
    listen 80;
    server_name example.com;
    
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/main.conf;
    
    location / {
        limit_req zone=crawler_limit burst=10 nodelay;
        
        if ($http_user_agent ~* (bot|crawler|spider)) {
            return 403;
        }
        
        proxy_pass http://backend;
    }
}