Daanial Farrukh

Thanks, Rishabh. That was the point of the article. The dashboard tells you a rule exists. Only a curl test tells you it works. On the free plan, rate limiting slows a bot down but does not stop it, so the WAF rules and origin lockdown do the real work. Glad it was useful.

Thanks Abhinav. Listen queue first: any value above 0 for more than a few seconds means requests are already waiting. Busy workers above 70 percent of pm.max_children is the early warning. Both come from the PHP-FPM status page. Error-rate alerts never see this, which is why the team spent two days looking for an attacker.