Defense in Depth

It was time to step back. In consulting, especially with legacy systems, you must remember a core philosophy: fight the local entropy, don't just write more code. The fundamental error was allowing malicious requests to travel too deep into the application stack. By the time PHP was evaluating whether a request was legitimate, the CPU cycles were already spent.

We needed a zero-intrusion architecture. No rewriting business logic. No expensive hardware migrations. We needed to protect the computationally expensive dynamic calculation layer (PHP/MySQL) by placing it behind a lightweight proxy and a rigid, network-level firewall.

The solution wasn't to fight the bots head-on, but to create a layered defense system that gracefully degraded under pressure. We would choke the malicious traffic at the perimeter, throttle the aggressive requests at the gate, and strictly ration the vital resources at the core.