Per-URL policy
Apply protection only where it matters.
IP blocking and release
Limit suspicious IPs and release them when needed.
Queue position
Show visitors where they stand in line.
Entry token
Allow only admitted visitors into protected pages.
Exceptions
Separate admins, internal networks, and callbacks.
Operational logs
See which rule affected which request.