◇ Could this help me?
Yes. Edge rate limiting on auth routes, bot management on high-value pages, and managed WAF rules covering the OWASP Top 10 are standard, well-supported controls, and the framing that an unconfigured edge protects nothing is accurate. Adopt it with one addition: edge rules cut volume and noise but do not replace server-side rate limiting, lockout, and input validation, because anything that reaches the origin directly goes around them. This is a general practice.
Review this application's edge configuration and produce a plan covering three gaps: rate limiting rules on login, registration, and password reset with specific per-IP thresholds, bot management rules on high-value routes such as pricing, checkout, and API documentation, and custom WAF rules for SQL injection, cross-site scripting, and path traversal. For each one, give me the exact rule definition, the risk of blocking a real user, and the server-side control that must still exist behind it.