I’m on the Hobby plan and have one published rate-limit rule for GET /api/account-closure/receipt: fixed window, 120 requests per 60 seconds, counted by IP. Its over-limit action is currently Log. I verified that it matches over-limit traffic.

When I edit that rule and select Too Many Requests (429), the dashboard opens an “Upgrade David Bowles to Pro” modal for “Advanced WAF protection.” I cancelled without saving, so the published rule is unchanged.

The WAF rate-limiting documentation lists one rule and the default 429 response as available on Hobby. Is the upgrade prompt expected for an existing Log-mode rule? If not, what is the supported way to switch this rule to standard 429 enforcement?

One suggested workaround was to stage deletion of the Log rule and create a replacement that keeps the default 429 action. Before I do that, can someone confirm whether the Hobby one-rule limit permits both changes in one draft and whether publishing replaces the rule without a protection gap? I don’t want to remove the working Log rule based on an unverified workaround.