Blog

First-person notes from Mac Clark on protecting public websites.

A client was taking 90 million requests an hour. The WAF was only half the fight.

Mac Clark · September 3, 2026

First-person account of a request flood on a client's public site and a second customer-facing portal — 90 million requests an hour, origin bypass, and what actually stopped it.