I'd have to whitelist every regular endpoint

That's why I started with "this might be to much work" 😆. Seems like there would be a way to do it without the automated bot blocking just using allow and deny (or challenge I guess it is here). The list would be a bitch to create by hand but shouldn't it exist already somewhere in the federation configs? If so you could broadly allow those while blocking or challenging otherwise. I guess it comes down to how do you identify bot traffic with free, without the tool on.

Full disclosure: I have CF Enterprise experience but I'm just guessing in the Lemmy/federation part and haven't messed with CF free.