We are having the same issues with ClaudeBot, but Cloudflare seems to be working pretty well. We have security rules in place to prevent the massive spikes.

As far as I know, we use Nhibernate for caching. I will ask our dev to look into this.

As we learn more about how these AI bots interacting with AbleCommerce, we can make improvements. Our recent focus has been primarily adding new features, but we will certainly look into the pros and cons of database caching.

Setting up rules in Cloudflare should prevent thousands of hits to any page. If you would like to share the security rules that you have setup now, I'm happy to share our configurations as well.

We shouldn't be forced to rely on an external caching system the system to be able to handle significant traffic. I see a pretty consistent ratio between the CPU usage for the w3wp.exe process and the SQL Server process where the SQL Server is around 4 times higher on spikes. So, for instance if the w3wp process hits 10% of CPU usage, the SQL Server will hit 50%. So, SQL Server is definitely more of the bottleneck for my system.
For the vast majority of sites, the product list queries and pricing are going to be the same regardless of whether the user is logged in or not. There needs to be intelligent caching involved so every page isn't built from scratch every time.
If you all have CloudFlare rules that address this, I'd love to see them. I'm currently just using Rate Limiting for bots to 1 visit per 10 seconds and then for (http.user_agent contains "Claude-SearchBot") I'm either doing a Managed Challenge or Blocking (when my server gets overloaded).

There strangest thing is Claude just keeps hammering the exact same page. I haven't been able to find anything about that page that should cause this:
In the last 24 hours:
Cloudflare detected 82.17k requests from Claude-SearchBot.

This is a 87.2% increase compared to the previous period.

www.crmagnetics.com/AC-Current-Transducers is the most crawled path with 81.53k successful requests.

82.06k crawls received an HTTP 403 response.
82.17k requests were from Claude-SearchBot.

Edited by user Friday, June 12, 2026 2:34:46 PM(UTC)  | Reason: Adding additional info

We've implemented an eTag caching fix for Categories for users that aren't authenticated that seems to be working great. I've turned off all CloudFlare mitigations, Claude is still hammering the site but the CPU usage rarely exceeds 25%.

Here's the new code for ValidateCategoryAttribute.cs

namespace AbleCommerce.Code
{
using System;
using System.Configuration;
using System.Data.SqlClient;
using System.Web;
using System.Web.Mvc;
using CommerceBuilder.Catalog;
using CommerceBuilder.Common;
using CommerceBuilder.DomainModel;
using CommerceBuilder.Users;
using CommerceBuilder.Utility;

public class ValidateCategoryAttribute : ActionFilterAttribute
{
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
base.OnActionExecuting(filterContext);
var context = filterContext.HttpContext;
if (filterContext.ParentActionViewContext == null && context != null)
{
int id = AlwaysConvert.ToInt(filterContext.RouteData.Values["Id"]);

if (!context.Request.IsAuthenticated)
{
string etag = GetCategoryETag(id);
if (etag != null)
{
context.Response.AppendHeader("ETag", etag);
context.Response.AppendHeader("Cache-Control", "no-cache, no-transform");

if (string.Equals(context.Request.Headers["If-None-Match"], etag, StringComparison.Ordinal))
{
filterContext.Result = new HttpStatusCodeResult(304, "Not Modified");
return;
}
}
}

var category = EntityLoader.Load<Category>(id);
if (category != null)
{
if ((category.Visibility == CatalogVisibility.Private) &&
(!AbleContext.Current.User.IsInRole(Role.CatalogAdminRoles)))
{
context.Response.Redirect(NavigationHelper.GetHomeUrl());
}

PageVisitHelper.RegisterPageVisit(category.Id, CatalogNodeType.Category, category.Name);
PageHelper.BindMetaTags(filterContext, category);
}
else NavigationHelper.Trigger404(HttpContext.Current.Response, "Invalid Category");
}
}

private static string GetCategoryETag(int categoryId)
{
if (categoryId == 0)
{
return null;
}
string connStr = ConfigurationManager.ConnectionStrings["AbleCommerce"]?.ConnectionString;
if (string.IsNullOrEmpty(connStr))
{
return null;
}

try
{
using (var conn = new SqlConnection(connStr))
{
using (var cmd = new SqlCommand(@"SELECT
BINARY_CHECKSUM(c.Name, c.Summary, c.Description, c.Title, c.MetaDescription, c.VisibilityId, c.IsFeatured, c.OuterTemplateId, c.InnerTemplateId),
(SELECT COUNT(*) FROM ac_CatalogNodes WHERE CategoryId = @id)
FROM ac_Categories c WHERE c.CategoryId = @id", conn))
{
{
cmd.Parameters.AddWithValue("@id", categoryId);
conn.Open();
using (var reader = cmd.ExecuteReader())
{
if (!reader.Read())
{
return null;
}
int checksum = reader.GetInt32(0);
int nodeCount = reader.GetInt32(1);
return string.Format("W/\"{0:X8}-{1}\"", checksum, nodeCount);
}
}
}
}
}
catch
{
return null;
}
}
}
}