They have rate limiting rules but they aren't on by default and are separate fro...

		eli 35 days ago \| parent \| context \| favorite \| on: 288,493 Requests – How I Spotted an XML-RPC Brute ... They have rate limiting rules but they aren't on by default and are separate from the WAF which is mostly stateless.