You could, but it's tricky to get right I feel. Most small websites use a form of bot detection for visitors to manage this. This might be a service like Cloudflare or an open source thing like Anubis for example.

There's different ways to tackle this and it sucks we are forced into putting time and effort to deal with it.

It's hard because the requests all come from different IPs, at least on my site. 185k "unique visitors" hit my site just yesterday, half from outside of North America, which is odd because my site is pretty local.