IP blocking doesn't prevent requests I am getting a lot of bad requests from a crawler at a specific IP Address non-stop. I added the IP to the blocked list and cleared the cache, but I still see more requests in the dblog coming in from the IP:

HTTP response: Bad Request. URL: https://valid.url.example.com/api/123456&gt;; rel="canonical",&lt;https:.json.


Why can they still send requests? Is there a way to prevent these?
Flood control is just for failed login attempts and some other stuff like forms being filled out.  It will not keep your bad bot from the site.

Assuming you have an Apache server, you can modify the .htaccess file in the root of your site to block specific ip with the DENY FROM {ip} directive. E.g. adding something like this to the top.

order allow,deny
deny from 255.0.0.0
deny from 123.45.6.
allow from all


If you don't have Apache / .htaccess support, the process will be different.