Can real users be blocked?
If policies are too aggressive, yes. Start with reviewed suggestions, manual application, and exception IPs.
Should every page use a queue?
No. Apply it to high-risk protected URLs such as events, reservations, and applications.
Will it slow down the server?
The protection flow is designed to be lightweight, but every environment should be tested.
Can it work with Cloudflare or a WAF?
Yes, but real visitor IP forwarding must be configured correctly.