Rate limiting is a quota: only N requests in a time window (per IP, account, or API key). After that, the server answers 429 Too Many Requests instead of running the expensive work — login, search, checkout, an API call such as a REST API.
It is not a WAF. A WAF inspects what the request is (SQL injection, XSS, known bad bots). Rate limiting inspects how often. Many WAFs (Cloudflare included) host rate-limit rules, but the idea is the same on the app itself. It is the first brake on a brute-force attack and on credential stuffing. It does not replace CAPTCHA, two-factor authentication, or a passkey. Honest humans who mistype a password twice still get in.
A real-life example of rate limiting
A Decatur boutique’s /wp-login.php has no cap. Bots try 200 passwords a second; the server wheezes; one lucky guess is admin. Cap it at five tries per IP per minute and the spray dies — a regular owner who fat-fingers the password waits a beat, then succeeds. Same logic on a public booking API: one café in Midtown should not be able to hammer availability 10,000 times.
Throttle logins first, then noisy endpoints. How-to: Cloudflare against brute-force and credential stuffing and 5 rapid actions.