导航|地址|刷新
Configurations




Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/learning-paths/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






Application Security (Learning Paths)

/





Account security


Overview

Set-up 2FA

Add and manage other members

Review active sessions

Review audit logs - v1

Audit Logs - v2 ↗Beta






Default traffic security


Overview

DDoS Protection

Browser Integrity

DNSSEC

SSL / TLS

Mutual TLS (mTLS)






Web Application Firewall


Overview

Managed Rules

Custom rules






Rate Limiting


Overview

Features

Use cases

Configurations






Lists


Overview

Features

Use cases

Configurations






Security Center


Overview

Security Insights

Brand Protection






Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Learning Paths llms.txt ↗

Learning Paths llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/Learning Paths

/…
Application Security


/Rate Limiting

/Configurations



Configurations


Last updated Apr 23, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewAdvanced configurationBest practices




Let's step through an example. If your /create-account page is being attacked, you will create a rule to limit the amount of requests, per counting characteristic, that you feel comfortable permitting through to your origin.

The rule below is being created on the free plan, which limits configuration options. The rule will trigger if the URI path matches /create-account, from the same IP address, after 5 requests and within a 10 second window, within each Cloudflare datacenter, globally.

------

------


Advanced configuration


In the previous module, we reviewed the various configurations available per plan. Using the same endpoint as an example, let us walk through another example, but with the additional advanced configurations.

The rule below is being created on the enterprise plan, so we are no longer limited to default configurations.

The rule will also limit the number of requests to /create-account, but will only trigger against POST requests. In the basic example, even requests with the GET method will increment the counter.

Requests that do not have a client certificate (mTLS), will increment the counter.

Requests will be counted using the IP with NAT support characteristic.

Within a 1 minute period, for each counted entity, if the number of requests exceeds 10, then the user will be presented with a Managed Challenge for a custom duration of 1 day.

------


Best practices


Rules that match identical criteria can be stacked together. For example, instead of creating just a single rule for /create-account, you can create multiple rules that match the same path but have different counting characteristics or request limits to protect against a threat that might behave dynamically.


PreviousUse casesNextOverview


Was this helpful?

YesNo

Edit pageReport issue




On this page

Overview

Advanced configuration

Best practices


Edit pageReport issue














Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search


Company
AboutCareersInvestorsPressPress kitGlobal network




Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG


Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse




Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog


Developers
DocumentationLearning centerCommunity




Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform


Start BuildingLog In












© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices








Docs




------
导航页 打开网址