!--- Crawler handling runs BEFORE deliberately. The PetalBot guard used to sit in the cfscript block below, which is after , so a blocked crawler still had a session created for it before the abort. Everything that decides whether a request gets a session, or how long that session lives, has to happen above the tag to have any effect. Why this matters: crawlers do not send cookies, so every crawler request creates a fresh session that then lives for the full session timeout. On 2026-09-08 two /24 subnets sent 462,000 requests with a spoofed "Chrome/48.0.2564.116" agent (a 2016 build), about 1,000 cookieless requests a minute. At the production timeout of 3600 seconds that accumulated roughly 55,000 concurrent sessions holding about 3.7GB of heap, which exhausted a 10GB heap and took the site down twice. Blocking those subnets belongs at the WAF, and that is being done separately. This is the application-side containment so that the next crawler - which will have a different agent string and different addresses - cannot do the same thing. --->
Sorry, we couldn't find that page!
If you would like to contact us about this issue, please call 800.939.9694.
Please click here or use our logo above to return to our homepage.