After signing up you add your domain and prove ownership with a DNS TXT record.
Requests reach the edge first. Clean traffic goes through to your origin; floods, scanners and blocked networks stop here.