How can I stop bots from filling the waiting room during high-demand sales?

Some basic filtering can reduce the volume considerably. During the sale window, challenge or rate-limit requests from datacenter ASNs, unusual networks, and clearly automated clients, while leaving normal residential traffic alone. This will not stop residential proxies or sophisticated scalpers, but it can remove a large amount of low-effort traffic before it reaches the queue.

The cleanest design is a pre-qualification step before the queue. Send visitors through a lightweight proof-of-work or rate-based challenge, then issue a short-lived signed token or HMAC cookie after they pass. Configure your edge security layer to reject requests without that valid token, so scripts hitting the queue URL directly never consume waiting-room slots.

The processing order is the main obstacle: if the waiting room runs before your Worker, putting Altcha in the Worker cannot protect the queue. Check whether edge WAF rules are evaluated early enough to rate-limit or challenge traffic on the sale path. If not, put a reverse proxy or edge function from another provider in front of the waiting room and filter requests there. IP limits, TLS fingerprints, and request-rate rules can help, although they are mitigation rather than a perfect bot block.

There is no reliable way to distinguish every serious scalper bot from a real customer. The better goal is layered friction: edge rate limits, network and fingerprint reputation, short-lived queue tokens, proof-of-work, and strict limits on how many sessions or purchases one identity can create. Robots.txt and crawler controls may reduce ordinary crawlers, but they will not stop bots specifically built for ticket sales.