Rate limiting vs. JS challenge: a Sydney forum absorbs a layer-7 flood

Rate limiting vs. JS challenge: a Sydney forum absorbs a layer-7 flood
A community site took a 90,000 requests-per-second HTTP flood aimed at its search endpoint. They reached for rate limiting first — block any IP over 50 req/min.
The botnet spread across 40,000 residential IPs, each sending 30 req/min. Every request slipped under the limit, and origin still fell over.
They swapped the edge rule to a JavaScript challenge on /search: real browsers solved it invisibly, headless bots couldn't.
Malicious requests reaching origin dropped 98%. Legitimate Sydney users saw a one-time 40ms challenge, then nothing.
Rate limit when abuse comes from few IPs or you must protect a login from credential stuffing. Challenge when the flood is distributed and low-and-slow per IP.
The number that mattered: 98% of attack traffic stopped at the edge.