Many different sites have many different ways of implementation and many people seem to have their most opinionated ones.
I would not have any external user interaction on my website at all.
It is MY website, it is made BY me, FOR me.
I actually have a small website where I publish photos, it is a simple static HTML/CSS page that I manually update in the code when I have new photo galleries (generated in digiKam) to link to.
This makes the site increadibly fast, there is zero access time to wait for a DB query to finnish, or a caching server to load or a google analytics script, it just loads instantly and looks great.
Since it is just HTML I don’t worry about anyone gaining access to the backend.
This also my answer, but better explained than I would have.
Much like every other implementation of a blocking system. Badly.
First off, block every Russian IP
client certificate
