Blocking is binary and blocking is brittle. When a botnet rotates through residential proxies, IP reputation stops working; when it runs a headless browser, JavaScript checks stop working. What still works is cost.
A Deflecto challenge asks the client to find a nonce whose hash meets a difficulty target. A browser solves it in about the time the page takes to appear. A botnet sending a million requests a minute has to solve a million puzzles a minute — and its operators pay for that CPU.
Adaptive difficulty
Difficulty rises with the risk score of the client and with the load on your origin. During a flood, the cost of each request goes up automatically; when the attack stops, it comes back down without anyone touching a setting.
Accessibility
Challenges require no interaction, work with screen readers and degrade gracefully for clients without JavaScript via a signed-cookie fallback for verified sessions.