Here's the high level description of how it works.

• Create a directory like /honeypot/ on your site
• Put some code in index.php within the directory
• Add the honeypot as an explicit "Disallow" in robots.txt
• Include a hidden link to to the honeypot on every page of your site
• If something accesses that page, write its IP address to your .htaccess
• The .htaccess bans the IP address from ever accessing your site again.

But, I thought that scrapers often used proxy networks so they retrieve through huge amounts of IP's.

Sounds simple and effective, interesting! Is there also an option to send a missile strike to the originating location ?

Alliteration always annoys

Have you considered using fail2ban instead of .htaccess and PHP?

Like fail2ban crawls your access log, sees a request to /honeypot and adds the IP to its banlist.

I have something similar running, if you try to login in my nextcloud too often you get fail2ban-ed too (instead of nextcloud disabling the user account which inconveniences me). Required forwarding the nextcloud logs to the nginx LXC but that works fine too...