One decision we made is to always give real users an escape hatch. Read the Docs very rarely issues outright blocks or bans to specific IPs or user agents. Instead, our "worst" is a JavaScript challenge, and if a user solves a challenge, they are very unlikely to get challenged again for the next day or so.

Finally, a competent response that doesn't leave the users hang out to dry.

I'm so tired of seeing incompetents with measures like "blackhole 2 continents" deployed even outside active attacks.