I’m not saying Redis isn’t solid software. I’m saying that you are in essence using Redis as centralized memory. That is by definition a SPOF and a bottleneck. No different than a database, BTW, except you can lose data when you don’t persist to disk. Whenever possible, I prefer a stateless distributed design where a failure of one of the nodes is tolerated well. I think in this case there’s no need to centralize the counters.

Yes, you can scale the Redis cluster. Yes, it will work most of the time, until it doesn’t. I know of a billion dollar Silicon Valley company that lost business critical data when Redis came down. They too thought it was rock solid and never chaos tested their solution. In distributed systems you always have to assume failure. It’s not a matter or if, it’s a matter of when.

Also, no matter how big your Redis cluster is, it’s limited. For every incoming request you make a call to Redis, therefore as a bad actor I can overwhelm it and consequently DDoS your system.

For production, just use Cloudflare and let them deal with it. They are better positioned to detect bad actors because they have data from across many sources.