Let’s say that I enable a rate-limiting rule with “*” as the URL, that is, rate-limit everything.
My domain gets about 500 Million requests per month, as counted by CF. That is, those are the requests that hit CF, meaning they include cached image/css/js files.
The number of requests that actually reach my server are about 9 Million.
Assuming I get no attack and all the requests get through, do I get billed for 9M or 500M requests?