Sites can now limit requests per path with up to 25 rate limiting rules, each keyed by IP, header, cookie or a JSON body field, and answering with block, a proof-of-work challenge or log only. A name can have its own list instead of the domain's. Rules are managed from the dashboard (with templates for login and one-time-code forms), the CLI, the API and MCP.
See the WAF documentation.