导航|地址|刷新
Rate limiting rules
图
Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






WAF

/




Overview

Get started

Concepts


Traffic detections


Overview

Attack score


Leaked credentials


Overview

Get started

Common API calls

Terraform examples

Example mitigation rules






Malicious uploads


Overview

Get started

Example rules

Common API calls

Terraform examples






AI Security for Apps


Overview

Get started

PII detection

Unsafe and custom topic detection

Prompt injection detection

Token counting

Example mitigation rules

Log mode vs production mode

Available fields





Bot score ↗


Threat intelligence


Overview

Get started

Example rules

Available fields










Custom rules


Overview

Create in the dashboard

Create via API

Create using Terraform ↗


Configure a rule with the Skip action


Overview

API examples

Skip options






Common use cases


Allow traffic from IP addresses in allowlist only

Allow traffic from search engine bots

Allow traffic from specific countries only

Block Microsoft Exchange Autodiscover requests

Block requests by attack score

Block traffic by geographical location

Block traffic from specific countries

Build a sequence rule within custom rules

Challenge bad bots

Configure token authentication

Exempt partners from Hotlink Protection

Issue challenge for admin user in JWT claim based on attack score

Require a specific cookie

Require known IP addresses in site admin area

Require specific HTTP headers

Require specific HTTP ports

Stop R-U-Dead-Yet? (R.U.D.Y.) attacks

Update custom rules for customers or partners





Custom rulesets






Rate limiting rules


Overview

Request rate calculation

Create in the dashboard

Create via API

Create using Terraform ↗

Find appropriate rate limit

Rate limiting parameters

Rule examples

Best practices

Troubleshooting






Managed rules


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Troubleshooting


Create exceptions


Overview

Add an exception in the dashboard

Add an exception via API






Log the payload of matched rules


Overview

Configure in the dashboard

View the payload content in the dashboard

Configure via API

Store decrypted matched payloads in logs


Command-line operations


Overview

Generate a key pair

Decrypt the payload content










Check for exposed credentialsDeprecated


Overview

How it works

Configure via API

Configure using Terraform

Test your configuration

Monitor exposed credentials events

Upgrade to leaked credentials detection






Rulesets reference


Cloudflare Managed Ruleset


Cloudflare OWASP Core Ruleset


Overview

Concepts

Evaluation example

Configure in the dashboard

Configure via API

Configure in Terraform ↗





Cloudflare Exposed Credentials Check Managed RulesetDeprecated

Cloudflare Sensitive Data Detection










Additional tools



Lists


Overview

Custom lists

Bulk Redirect Lists ↗

Managed Lists

Create in the dashboard

Use lists in expressions


Lists API


Overview

JSON object

Endpoints










IP Access rules


Overview

Create a rule

Parameters

Actions






Scrape Shield


Overview

Email Address Obfuscation

Hotlink Protection





User Agent Blocking

Zone Lockdown

Browser Integrity Check

Enable security.txt ↗

Privacy Pass

Replace insecure JS libraries

Security Level

Validation checks






Account-level configuration


Overview


Custom rulesets


Overview

Use the dashboard

Use the API

Use Terraform ↗






Rate limiting rulesets


Overview

Create in the dashboard

Create via API

Create using Terraform ↗






Managed rulesets


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Create exceptions ↗










Analytics


Security Analytics

Security Events





Security features interoperability


Reference


Alerts

Phases


Legacy features



WAF managed rules (previous version)


Overview

Troubleshooting

WAF managed rules upgrade






Rate Limiting (previous version)


Overview

Troubleshooting

Rate limiting upgrade





Firewall rules ↗

Firewall rules upgrade










Troubleshooting


Bing's Site Scan blocked by a managed rule

Fake bot detection blocking legitimate requests

Issues sharing to Facebook

SameSite cookie interaction with Cloudflare

Rule phase interactions

FAQ





Glossary


Changelog


Overview

Changelog

Scheduled changes

Historical (2024)

Historical (2023)

Historical (2022)






Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

WAF llms.txt ↗

WAF llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/WAF

/Rate limiting rules



Rate limiting rules


Last updated Apr 22, 2026|Copy as Markdown|View as Markdown|Agent setup




Rate limiting rules allow you to define rate limits for requests matching an expression, and the action to perform when those rate limits are reached. Use rate limiting rules to prevent abuse of your websites and APIs — for example, to protect a login endpoint from brute-force attacks or to cap how many API calls a single client can make in a given time window.


Were you blocked from accessing a website?


If you are a visitor who received an error while trying to access a website, please refer to the error 1015 documentation.



In the new security dashboard, rate limiting rules are one of the available types of security rules. Security rules perform security-related actions on incoming requests that match specified filters.

Some Enterprise customers can create rate limiting rulesets at the account level that they can deploy to multiple Enterprise zones.


Rule parameters


Like other rules evaluated by Cloudflare's Ruleset Engine, rate limiting rules have the following basic parameters:

An expression that specifies the criteria you are matching traffic on using the Rules language.

An action that specifies what to perform when there is a match for the rule and any additional conditions are met. In the case of rate limiting rules, the action occurs when the rate reaches the specified limit.

Besides these two parameters, rate limiting rules require the following additional parameters:

Characteristics: The set of parameters that define how Cloudflare tracks the rate for this rule.

Period: The period of time to consider (in seconds) when evaluating the rate.

Requests per period: The number of requests over the period of time that will trigger the rate limiting rule.

Duration (or mitigation timeout): Once the rate is reached, the rate limiting rule blocks further requests for the period of time defined in this field.

Action behavior: By default, Cloudflare will apply the rule action for the configured duration (or mitigation timeout), regardless of the request rate during this period. Some Enterprise customers can configure the rule to throttle requests over the maximum rate, allowing incoming requests when the rate is lower than the configured limit.

Refer to Rate limiting parameters for more information on mandatory and optional parameters.

Refer to How Cloudflare determines the request rate to learn how Cloudflare uses the parameters above when determining the rate of incoming requests.


Interaction with other app security features


If you are using several app security features like custom rules, Managed Rules, and Super Bot Fight Mode, it is important to understand how these features interact and the order in which they execute. Refer to Security features interoperability for more information.


Important remarks



Rate limiting rules are evaluated in order, and some actions like Block will stop the evaluation of other rules. For more details on actions and their behavior, refer to Actions.



Rate limiting rules are not designed to allow a precise number of requests to reach your origin server. There may be a delay of up to a few seconds between detecting a request and updating rate counters. Due to this delay, excess requests could still reach the origin before Cloudflare enforces a mitigation action such as blocking or challenging. For more information on how counters work, including their per-data-center scope, refer to Request rate calculation.



Applying rate limiting rules to verified bots might affect Search Engine Optimization (SEO). For more information, refer to Improve SEO.


------


Availability



FeatureFreeProBusinessEnterprise with app securityEnterprise with Advanced Rate Limiting
Available fields
in rule expression		Path, Verified BotHost, URI, Path, Full URI, Query, Verified BotHost, URI, Path, Full URI, Query, Method, Source IP, User Agent, Verified BotGeneral request fields, request header fields, Verified Bot, Bot Management fields1General request fields, request header fields, Verified Bot, Bot Management fields1, request body fields2
Cache exclusionNoNoYesYesYes
Counting characteristicsIPIPIP, IP with NAT supportIP, IP with NAT supportIP, IP with NAT support, Query, Host, Headers, Cookie, ASN, Country, Path, JA3/JA4 Fingerprint1, JSON field value2, Body2, Form input value2, Custom
Custom counting expressionNoNoYesYesYes
Available fields
in counting expression		N/AN/AAll rule expression fields, Response code, Response headersAll rule expression fields, Response code, Response headersAll rule expression fields, Response code, Response headers
Counting modelNumber of requestsNumber of requestsNumber of requestsNumber of requestsNumber of requests, complexity score
Rate limiting
action behavior		Perform action during mitigation periodPerform action during mitigation periodPerform action during mitigation periodPerform action during mitigation period, Throttle requests above rate with block actionPerform action during mitigation period, Throttle requests above rate with block action
Counting periods10 sAll supported values up to 1 min3All supported values up to 10 min3All supported values up to 65,535 s3All supported values up to 65,535 s3
Mitigation timeout periods10 sAll supported values up to 1 h3All supported values up to 1 day3All supported values up to 1 day34All supported values up to 1 day34
Number of rules1251005100



Footnotes

1: Only available to Enterprise customers who have purchased Bot Management.

2: Availability depends on your WAF plan.

3: List of supported counting/mitigation period values in seconds:
10, 15, 20, 30, 40, 45, 60 (1 min), 90, 120 (2 min), 180 (3 min), 240 (4 min), 300 (5 min), 480, 600 (10 min), 900, 1200 (20 min), 1800, 2400, 3600 (1 h), 65535, 86400 (1 day).
Not all values are available on all plans.

4: Enterprise customers can specify a custom mitigation timeout period via API.

5: Enterprise customers must have application security on their contract to get access to rate limiting rules. The number of rules depends on the exact contract terms.



Footnotes



Only available to Enterprise customers who have purchased Bot Management. ↩↩2↩3



Availability depends on your WAF plan. ↩↩2↩3↩4



Supported period values in seconds:
10, 15, 20, 30, 40, 45, 60 (1 min), 90, 120 (2 min), 180 (3 min), 240 (4 min), 300 (5 min), 480, 600 (10 min), 900, 1200 (20 min), 1800, 2400, 3600 (1 h), 65535, 86400 (1 day). ↩↩2↩3↩4↩5↩6↩7↩8



Enterprise customers can specify a custom mitigation timeout period via API. ↩↩2



Enterprise customers must have application security on their contract to get access to rate limiting rules. The number of rules depends on the exact contract terms. ↩




Note


Enterprise customers can preview this product as a non-contract service, which provides full access, free of metered usage fees, limits, and certain other restrictions.




Next steps


Refer to the following resources:

Create a rate limiting rule in the dashboard for a zone

Create a rate limiting rule via API for a zone

For Terraform examples, refer to Rate limiting rules configuration using Terraform.

------


Related resources



Learning Center: What is rate limiting? ↗



Cloudflare Rate Limiting (previous version, no longer available): Documentation for the previous version of rate limiting rules (billed based on usage).



PreviousCustom rulesetsNextRequest rate calculation


Was this helpful?

YesNo

Edit pageReport issue














Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search


Company
AboutCareersInvestorsPressPress kitGlobal network




Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG


Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse




Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog


Developers
DocumentationLearning centerCommunity




Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform


Start BuildingLog In











…(内容过长已截断)

------
导航页 打开网址