It's only a deterrence, not a defense. The attacked can always wait it out, or attack multiple sites at once to slow things down. You also have to watch out fo

It's only a deterrence, not a defense. The attacked can always wait it out, or attack multiple sites at once to slow things down. You also have to watch out for rate limiting becoming a way for attackers to DDoS your legitimate users.