Case: One Rate-Limit Rule Absorbed a 220k-Request Burst

Case: One Rate-Limit Rule Absorbed a 220k-Request Burst
A Black Friday landing page got hit with a layer-7 burst: 220,000 requests in 11 minutes from 1,400 IPs, all hammering /?s= search.

WAF SOP we keep ready:

— Step 1: Rate-limit by path. /?s= capped at 10 req/min per IP.
— Step 2: Challenge, don't block — serve a managed challenge so real shoppers pass.
— Step 3: Cache the search-empty response for 60s so origin never sees repeats.
— Step 4: Watch origin requests/sec in the dashboard during the event.

Outcome: Of 220k edge requests, only 3,100 reached origin (98.6% absorbed). Origin stayed under 40% CPU. Checkout uptime: 100% through the burst.

Run this every time.