导航|地址|刷新
Features

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/learning-paths/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

Application Security (Learning Paths)

/

Account security

Overview

Set-up 2FA

Add and manage other members

Review active sessions

Review audit logs - v1

Audit Logs - v2 ↗Beta

Default traffic security

Overview

DDoS Protection

Browser Integrity

DNSSEC

SSL / TLS

Mutual TLS (mTLS)

Web Application Firewall

Overview

Managed Rules

Custom rules

Rate Limiting

Overview

Features

Use cases

Configurations

Lists

Overview

Features

Use cases

Configurations

Security Center

Overview

Security Insights

Brand Protection

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Learning Paths llms.txt ↗

Learning Paths llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/Learning Paths

/…
Application Security

/Rate Limiting

/Features

Features

Last updated Apr 23, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewFeatures by plan type

Rate limiting is composed of the following parameters:

An expression that specifies the criteria you are matching traffic on using the Rules language.

An action that specifies what to perform when there is a match for the rule and any additional conditions are met. In the case of rate limiting rules, the action occurs when the rate reaches the specified limit.

Besides these two parameters, rate limiting rules require the following additional parameters:

Characteristics: The set of parameters that define how Cloudflare tracks the rate for this rule.

Period: The period of time to consider (in seconds) when evaluating the rate.

Requests per period: The number of requests over the period of time that will trigger the rate limiting rule.

Duration (or mitigation timeout): Once the rate is reached, the rate limiting rule blocks further requests for the period of time defined in this field.

Action behavior: By default, Cloudflare will apply the rule action for the configured duration (or mitigation timeout), regardless of the request rate during this period. Some Enterprise customers can configure the rule to throttle requests over the maximum rate, allowing incoming requests when the rate is lower than the configured limit.

Features by plan type

Features vary by plan type.

Feature Free Pro Business Enterprise with app security Enterprise with Advanced Rate Limiting
Available fields
in rule expression Path, Verified Bot Host, URI, Path, Full URI, Query, Verified Bot Host, URI, Path, Full URI, Query, Method, Source IP, User Agent, Verified Bot General request fields, request header fields, Verified Bot, Bot Management fields1 General request fields, request header fields, Verified Bot, Bot Management fields1, request body fields2
Cache exclusion No No Yes Yes Yes
Counting characteristics IP IP IP, IP with NAT support IP, IP with NAT support IP, IP with NAT support, Query, Host, Headers, Cookie, ASN, Country, Path, JA3/JA4 Fingerprint1, JSON field value2, Body2, Form input value2, Custom
Custom counting expression No No Yes Yes Yes
Available fields
in counting expression N/A N/A All rule expression fields, Response code, Response headers All rule expression fields, Response code, Response headers All rule expression fields, Response code, Response headers
Counting model Number of requests Number of requests Number of requests Number of requests Number of requests, complexity score
Rate limiting
action behavior Perform action during mitigation period Perform action during mitigation period Perform action during mitigation period Perform action during mitigation period, Throttle requests above rate with block action Perform action during mitigation period, Throttle requests above rate with block action
Counting periods 10 s All supported values up to 1 min3 All supported values up to 10 min3 All supported values up to 65,535 s3 All supported values up to 65,535 s3
Mitigation timeout periods 10 s All supported values up to 1 h3 All supported values up to 1 day3 All supported values up to 1 day34 All supported values up to 1 day34
Number of rules 1 2 5 1005 100

Footnotes

1: Only available to Enterprise customers who have purchased Bot Management.

2: Availability depends on your WAF plan.

3: List of supported counting/mitigation period values in seconds:
10, 15, 20, 30, 40, 45, 60 (1 min), 90, 120 (2 min), 180 (3 min), 240 (4 min), 300 (5 min), 480, 600 (10 min), 900, 1200 (20 min), 1800, 2400, 3600 (1 h), 65535, 86400 (1 day).
Not all values are available on all plans.

4: Enterprise customers can specify a custom mitigation timeout period via API.

5: Enterprise customers must have application security on their contract to get access to rate limiting rules. The number of rules depends on the exact contract terms.

Footnotes

Only available to Enterprise customers who have purchased Bot Management. ↩↩2↩3

Availability depends on your WAF plan. ↩↩2↩3↩4

Supported period values in seconds:
10, 15, 20, 30, 40, 45, 60 (1 min), 90, 120 (2 min), 180 (3 min), 240 (4 min), 300 (5 min), 480, 600 (10 min), 900, 1200 (20 min), 1800, 2400, 3600 (1 h), 65535, 86400 (1 day). ↩↩2↩3↩4↩5↩6↩7↩8

Enterprise customers can specify a custom mitigation timeout period via API. ↩↩2

Enterprise customers must have application security on their contract to get access to rate limiting rules. The number of rules depends on the exact contract terms. ↩

PreviousOverview NextUse cases

Was this helpful?

YesNo

Edit page Report issue

On this page

Overview

Features by plan type

Edit page Report issue

Getting started
Plans Contact sales Partners Find a partner Startups Under attack?Domain name search

Company
About Careers Investors Press Press kit Global network

Public interest
Project Galileo Athenian Project Cloudflare for Campaigns Project Fairshot Impact/ESG

Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse

Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog

Developers
DocumentationLearning centerCommunity

Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform

Start BuildingLog In

© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices

Docs

------
导航页打开网址

Feature	Free	Pro	Business	Enterprise with app security	Enterprise with Advanced Rate Limiting
Available fields in rule expression	Path, Verified Bot	Host, URI, Path, Full URI, Query, Verified Bot	Host, URI, Path, Full URI, Query, Method, Source IP, User Agent, Verified Bot	General request fields, request header fields, Verified Bot, Bot Management fields1	General request fields, request header fields, Verified Bot, Bot Management fields1, request body fields2
Cache exclusion	No	No	Yes	Yes	Yes
Counting characteristics	IP	IP	IP, IP with NAT support	IP, IP with NAT support	IP, IP with NAT support, Query, Host, Headers, Cookie, ASN, Country, Path, JA3/JA4 Fingerprint1, JSON field value2, Body2, Form input value2, Custom
Custom counting expression	No	No	Yes	Yes	Yes
Available fields in counting expression	N/A	N/A	All rule expression fields, Response code, Response headers	All rule expression fields, Response code, Response headers	All rule expression fields, Response code, Response headers
Counting model	Number of requests	Number of requests	Number of requests	Number of requests	Number of requests, complexity score
Rate limiting action behavior	Perform action during mitigation period	Perform action during mitigation period	Perform action during mitigation period	Perform action during mitigation period, Throttle requests above rate with block action	Perform action during mitigation period, Throttle requests above rate with block action
Counting periods	10 s	All supported values up to 1 min3	All supported values up to 10 min3	All supported values up to 65,535 s3	All supported values up to 65,535 s3
Mitigation timeout periods	10 s	All supported values up to 1 h3	All supported values up to 1 day3	All supported values up to 1 day34	All supported values up to 1 day34
Number of rules	1	2	5	1005	100