As someone running a web app, I can see the appeal. I get tens of thousands of "attacks" per day from bots scanning for WordPress/PHP files and that's not even

As someone running a web app, I can see the appeal. I get tens of thousands of "attacks" per day from bots scanning for WordPress/PHP files and that's not even counting the "legitimate" bot traffic crawling your site for content or AI training data. Now, tens of thousands of requests probably won't do much if you have basic security, caching, and optimization in place. But if your app is a mess, sometimes it's easier to just slap a Cloudflare gate on it and call it a day.