table <abusive_hosts> persist
block in quick from <abusive_hosts>

pass in on $ext_if proto tcp to $web_server port www \ 
flags S/SA keep state \
(max-src-conn 100, max-src-conn-rate 15/5, overload <abusive_hosts> flush)

1. define a table to store abusive hosts
2. block the abusive hosts
3. pass traffic to the web server
4. you need “flags S/SA keep state”
5. if a host creates more than 100 at a time or creates 15 connections a sec it is placed in abusive_hosts