Thanks, Rishabh. That was the point of the article. The dashboard tells you a rule exists. Only a curl test tells you it works. On the free plan, rate limiting slows a bot down but does not stop it, so the WAF rules and origin lockdown do the real work. Glad it was useful.

Fair point on the WAF rules doing the real work. One cheap trick worth adding: pair the curl checks with Security > Events filtered by blocked, so you can see exactly which rule fired per request. It closes the loop between the dashboard and the terminal.