Good point. I have experience with Rack attack on application level. Would you recommend webserver instead (nginx)? Or even Cloudflare? (I bet they have a solution).