content: I'm not well versed in the subject, so take this with a grain of salt. Perhaps someone could give a more detailed explanation and correct me. In simple terms, bots can be identified by various things such as similar requests to certain addresses/pages, user agents, and IP addresses. It would only be a matter of blocking connections or IPs (blocking IPs is useless if they're spoofing TCP source addresses, but that's another story) that match these patterns. Voat uses CloudFlare which is very good at filtering these types of attacks, among other things. The recent attack on Voat was an application layer DDoS attack which attacks the software, rather than the network capacity. These are harder to pull off than classic DDoS attacks and makes sense since Voat is still in alpha.