Choose Monitor or Enforce and tune request limits

Where: Protection settings

Steps

1. Keep Monitor while observing representative ordinary visitors.
2. Set requests per address/window, window seconds and temporary-block duration within the manifest limits.
3. Review member and loopback exemptions.
4. Remember visitors behind one NAT can share a counter. Check the core client IP before any enforcement.
5. Switch to Enforce only after a controlled non-admin test and an accessible recovery path.
6. If you need a clean transition use the intended counter/block reset, then recheck the real audience.

Check the result

Monitor records without enforcing the added denials; Enforce activates the configured protection. Moving modes does not automatically reset existing counters.

If it does not work

Fixed-window boundaries allow bursts. This counts PHP requests reaching the hook, not static files or network-level DDoS traffic. An authenticated admin bypass is unsuitable for proving normal visitor enforcement.