False positives: don't block the living

The key point: our worker blocks nobody

The client script, on a high score, sends a report to sementsul.net/api/report-bot and passes the request through (return fetch(request)). A real visitor notices nothing even on a false score: no captchas, no 403.

And if you cut by blocklist on your server?

• Don't apply the base to white bots: verify Googlebot and Bingbot by reverse DNS, not IP.
• Start in log-only mode: log matches for a week (bot signals), then enable DROP.
• Watch the metrics: Observability → Workers Logs shows every report.
• The ?bot_trigger=1 parameter is only for connectivity checks, not for banning yourself.