How can I keep Bingbot from pushing my site CPU so high?

First make sure the traffic really is Bingbot. User-Agent strings are easy to fake, so check the request logs and verify the source addresses using Bing’s published bot-verification method before blocking anything. Otherwise, you could end up targeting unrelated visitors.

If the requests are genuine, look for repeated URLs, redirect chains, or pages that trigger expensive queries. Those can make a crawler load look much worse than the raw request count suggests.

robots.txt is a request to a crawler, not an enforcement mechanism. If you need to protect the server, use your web server or a CDN to apply rate limits, caching, or a block rule. Start with a per-IP or per-path limit if possible, and watch for effects on legitimate traffic.

A blanket block based only on the User-Agent is quick, but it is also easy to spoof and can block more than you intend.

Check Bing Webmaster Tools if you can verify ownership. It may give you options to manage crawl activity and help show whether Bing is encountering a particular section of the site unusually often. Also inspect your logs for URL patterns that point to pagination, parameter combinations, or redirect loops.

If the crawl is causing real outages, protecting the origin with caching or rate limiting matters more than adding another robots.txt rule.

Be careful with crawl-delay. Support and behavior can vary, and a robots.txt directive cannot make an uncooperative or unrelated bot slow down. If you want to stop crawling entirely, a broad disallow rule may be simpler, but it still only works for crawlers that choose to follow it.