The honesty about free-plan rate limiting being a speed bump, not a lock, is the part most guides skip. And proving each rule with a curl command instead of trusting the dashboard is exactly the habit that separates a setup from a posture.
Thanks, Rishabh. That was the point of the article. The dashboard tells you a rule exists. Only a curl test tells you it works. On the free plan, rate limiting slows a bot down but does not stop it, so the WAF rules and origin lockdown do the real work. Glad it was useful.
Fair point on the WAF rules doing the real work. One cheap trick worth adding: pair the curl checks with Security > Events filtered by blocked, so you can see exactly which rule fired per request. It closes the loop between the dashboard and the terminal.
Rishabh Mishra
Cloud FullStack Developer & Design Engineer.
The honesty about free-plan rate limiting being a speed bump, not a lock, is the part most guides skip. And proving each rule with a curl command instead of trusting the dashboard is exactly the habit that separates a setup from a posture.