- always assign jwt and enable human verification even logged out
- DDOS protection
- Need DDOS detection that when activated can prioritize human validated over others
- user rate limit from cache so no db hits needed
- Nice because applies to all sessions under 1 user
- rate limit IP’s
- How to handle VPN’s, likely just ban together if DDOS
- nginx disable or server check?
- How to prioritize traffic IE how to ratchet up protection until server is stable then ratchet down