I've been reading through Jonas Czech's popular How To Prevent Scraping guide to help prevent harvesting of content on a Laravel site I'm responsible for. Several of the guide's suggestions involve filtering requests by identifiers like IP address and user agent, and then either blocking them or showing challenges like reCAPTCHAs. Presumably this sort of filtering would be most efficiently done at the server configuration level using Nginx config files or Apache's htaccess, but can also be done in application code.
The problem is that I've seen it stated in a few places elsewhere that filtering requests on my own server - as opposed to on the cloud by putting Cloudflare in front of the site and using their many equivalent offerings - can result in the server quickly becoming overloaded with requests (and therefore DOSed or DDOSed).
If my site is running on a cheap VPS like a Digital Ocean droplet, is implementing such a feature likely to make the server fall over? Or in other words, does filtering incoming requests typically add a high overhead to the server's compute?