My company has a product which is downloadable through our website. Since day one, we've been continuously spammed by bots trying to download a little bit of content all the time (usually 4 MB out of 15).
We've tried a couple of techniques to protect ourselves, but they've all failed. We'll end up using a captcha if there's no other way around, but I'd really like to avoid hurting the download experience for our customers. I've seen numbers of websites proposing to download a piece of software without a captcha, so I'm pretty sure there's a solution.
Technically, it's a Wordpress environment, with an Apache webserver in a very simple Linux architecture.
What should we do to avoid those spammers? I'm not sure it matters, but most of the IPs come from China.