---
title: "Discussion on \"Why Rate Limiting Alone Won't Stop OTP Abuse — A Real Incident Breakdown\" | Hashnode"
description: "Discussion on \"Why Rate Limiting Alone Won't Stop OTP Abuse — A Real Incident Breakdown\". Protecting OTP Endpoints from Distributed Bot Attacks with AWS WAF CAPTCHA and Cloudflare Turnstile"
url: "https://hashnode.com/posts/why-rate-limiting-alone-won-t-stop-otp-abuse-a-real-incident-breakdown/6a1933e052c4918e262f04ee"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Why Rate Limiting Alone Won't Stop OTP Abuse — A Real Incident Breakdown](https://poly4.hashnode.dev/why-rate-limiting-alone-won-t-stop-otp-abuse-a-real-incident-breakdown?utm_source=hashnode&utm_medium=feed)

Protecting OTP Endpoints from Distributed Bot Attacks with AWS WAF CAPTCHA and Cloudflare Turnstile

May 29 · 11 min read · poly4.hashnode.dev  
Read the article

-   [#cloudflare](https://hashnode.com/tag/cloudflare)
-   [#attack](https://hashnode.com/tag/attack)
-   [#waf](https://hashnode.com/tag/waf)
-   [#captcha](https://hashnode.com/tag/captcha)

## Written by

[Mubarak Alhazan](https://hashnode.com/@poly4)

@poly4

  
[View profile](https://hashnode.com/@poly4)

DevOps Engineer

## Responses 1

Markdown supported · ⌘↵ to post

[Apalowo Abdulwasiu](https://hashnode.com/@Bazzan)

[Jun 3](https://hashnode.com/posts/why-rate-limiting-alone-won-t-stop-otp-abuse-a-real-incident-breakdown/6a1933e052c4918e262f04ee/comment/6a205e6d78a43e3153ad4e6c)

Great write-up mate. "Treat abuse protection for public facing endpoints as a first-class requirement not an afterthought" :+1

I do wonder, what was the attacker's endgoal? Cost the company its reputation?