Seems a mistake to disable the (I assume) faster-to-generate api. Bots will go back to scraping the website itself, increasing load.

Setting the API to require a token and adding a honeypot to the pages themselves seems like a decent solution.