导航|地址|刷新
Rate limiting best practices

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

WAF

/

Overview

Get started

Concepts

Traffic detections

Overview

Attack score

Leaked credentials

Overview

Get started

Common API calls

Terraform examples

Example mitigation rules

Malicious uploads

Overview

Get started

Example rules

Common API calls

Terraform examples

AI Security for Apps

Overview

Get started

PII detection

Unsafe and custom topic detection

Prompt injection detection

Token counting

Example mitigation rules

Log mode vs production mode

Available fields

Bot score ↗

Threat intelligence

Overview

Get started

Example rules

Available fields

Custom rules

Overview

Create in the dashboard

Create via API

Create using Terraform ↗

Configure a rule with the Skip action

Overview

API examples

Skip options

Common use cases

Allow traffic from IP addresses in allowlist only

Allow traffic from search engine bots

Allow traffic from specific countries only

Block Microsoft Exchange Autodiscover requests

Block requests by attack score

Block traffic by geographical location

Block traffic from specific countries

Build a sequence rule within custom rules

Challenge bad bots

Configure token authentication

Exempt partners from Hotlink Protection

Issue challenge for admin user in JWT claim based on attack score

Require a specific cookie

Require known IP addresses in site admin area

Require specific HTTP headers

Require specific HTTP ports

Stop R-U-Dead-Yet? (R.U.D.Y.) attacks

Update custom rules for customers or partners

Custom rulesets

Rate limiting rules

Overview

Request rate calculation

Create in the dashboard

Create via API

Create using Terraform ↗

Find appropriate rate limit

Rate limiting parameters

Rule examples

Best practices

Troubleshooting

Managed rules

Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Troubleshooting

Create exceptions

Overview

Add an exception in the dashboard

Add an exception via API

Log the payload of matched rules

Overview

Configure in the dashboard

View the payload content in the dashboard

Configure via API

Store decrypted matched payloads in logs

Command-line operations

Overview

Generate a key pair

Decrypt the payload content

Check for exposed credentialsDeprecated

Overview

How it works

Configure via API

Configure using Terraform

Test your configuration

Monitor exposed credentials events

Upgrade to leaked credentials detection

Rulesets reference

Cloudflare Managed Ruleset

Cloudflare OWASP Core Ruleset

Overview

Concepts

Evaluation example

Configure in the dashboard

Configure via API

Configure in Terraform ↗

Cloudflare Exposed Credentials Check Managed RulesetDeprecated

Cloudflare Sensitive Data Detection

Additional tools

Lists

Overview

Custom lists

Bulk Redirect Lists ↗

Managed Lists

Create in the dashboard

Use lists in expressions

Lists API

Overview

JSON object

Endpoints

IP Access rules

Overview

Create a rule

Parameters

Actions

Scrape Shield

Overview

Email Address Obfuscation

Hotlink Protection

User Agent Blocking

Zone Lockdown

Browser Integrity Check

Enable security.txt ↗

Privacy Pass

Replace insecure JS libraries

Security Level

Validation checks

Account-level configuration

Overview

Custom rulesets

Overview

Use the dashboard

Use the API

Use Terraform ↗

Rate limiting rulesets

Overview

Create in the dashboard

Create via API

Create using Terraform ↗

Managed rulesets

Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Create exceptions ↗

Analytics

Security Analytics

Security Events

Security features interoperability

Reference

Alerts

Phases

Legacy features

WAF managed rules (previous version)

Overview

Troubleshooting

WAF managed rules upgrade

Rate Limiting (previous version)

Overview

Troubleshooting

Rate limiting upgrade

Firewall rules ↗

Firewall rules upgrade

Troubleshooting

Bing's Site Scan blocked by a managed rule

Fake bot detection blocking legitimate requests

Issues sharing to Facebook

SameSite cookie interaction with Cloudflare

Rule phase interactions

FAQ

Glossary

Changelog

Overview

Changelog

Scheduled changes

Historical (2024)

Historical (2023)

Historical (2022)

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

WAF llms.txt ↗

WAF llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/WAF

/Rate limiting rules

/Best practices

Rate limiting best practices

Last updated May 5, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewEnforcing granular access control Limit by user agent Limit reuse of a single cf_clearance cookie Allow specific IP addresses or ASNs Limit by referrer Limit by destination hostProtecting against credential stuffing Protect OTP and verification endpointsLimiting the number of operations Prevent content scraping (via query string) Prevent content scraping (via body) Limit requests from botsProtecting REST APIs Prevent volumetric attacks Protect resourcesProtecting GraphQL APIs Limit the number of operations Limit the total amount of query complexity Limit any individual query’s complexity

The following sections cover typical rate limiting configurations for common use cases. You can combine the provided example rules and adjust them to your own scenario.

The main use cases for rate limiting are the following:

Enforce granular access control to resources. Includes access control based on criteria such as user agent, IP address, referrer, host, country, and world region.

Protect against credential stuffing and account takeover attacks.

Limit the number of operations performed by individual clients. Includes preventing scraping by bots, accessing sensitive data, bulk creation of new accounts, and programmatic buying in ecommerce platforms.

Protect REST APIs from resource exhaustion (targeted DDoS attacks) and resources from abuse in general.

Protect GraphQL APIs by preventing server overload and limiting the number of operations.

Enforcing granular access control

Limit by user agent

A common use case is to limit the rate of requests performed by individual user agents. The following example rule allows a mobile app to perform a maximum of 100 requests in 10 minutes. You could also create a separate rule limiting the rate for desktop browsers.

Setting Value
Matching criteria User Agent equals MobileApp
Expression http.user_agent eq "MobileApp"
Counting characteristics IP
Rate (Requests / Period) 100 requests / 10 minutes
Action Managed Challenge

Limit reuse of a single cf_clearance cookie

After a visitor successfully passes a Managed Challenge, Cloudflare issues a cf_clearance cookie to identify them as verified. However, malicious actors may attempt to reuse or share a single valid cf_clearance value across multiple requests or devices to bypass additional challenges.

This rate limiting rule helps mitigate such abuse by restricting how many requests can be made with the same cf_clearance value within a defined period. Legitimate human users will remain unaffected, while automated or replayed requests using a single clearance token will be blocked once the threshold is exceeded.

Setting Value
Matching criteria URI Path equals /checkout
Expression http.request.uri.path eq "/checkout"
Counting characteristics Cookie (cf_clearance)
Rate (Requests / Period) 100 requests / 10 minutes
Action Block

Allow specific IP addresses or ASNs

Another use case when controlling access to resources is to exclude or include IP addresses or Autonomous System Numbers (ASNs) from a rate limiting rule.

The following example rule allows up to 10 requests per minute from the same IP address doing a GET request for /status, as long as the visitor's IP address is not included in the partner_ipsIP list.

Setting Value
Matching criteria URI Path equals /status and Request Method equals GET and IP Source Address is not in list partner_ips
Expression http.request.uri.path eq "/status" and http.request.method eq "GET" and not ip.src in $partner_ips
Counting characteristics IP
Rate (Requests / Period) 10 requests / 1 minute
Action Managed Challenge

Limit by referrer

Some applications receive requests originated by other sources (for example, used by advertisements linking to third-party pages). You may wish to limit the number of requests generated by individual referrer pages to manage quotas or avoid indirect DDoS attacks.

Setting Value
Matching criteria URI Path equals /status and Request Method equals GET
Expression http.request.uri.path eq "/status" and http.request.method eq "GET"
Counting characteristics Header (Referer) 1
Rate (Requests / Period) 100 requests / 10 minutes
Action Block

This example rule requires Advanced Rate Limiting.

Limit by destination host

SaaS applications or customers using Cloudflare SSL for SaaS might have thousands of hosts under the same zone, which makes creating individual rules per host impractical. To overcome this, you can create a rate limiting rule that uses the host as a counting characteristic.

The following example rule will track the rate of requests to the /login endpoint for each host:

Setting Value
Matching criteria URI Path equals /login and Request Method equals GET
Expression http.request.uri.path eq "/login" and http.request.method eq "GET"
Counting characteristics IP and Host
Rate (Requests / Period) 10 requests / 10 minutes
Action Block

This example rule requires Advanced Rate Limiting.

Protecting against credential stuffing

A typical use case of rate limiting is to protect a login endpoint against attacks such as credential stuffing ↗. The following example contains three different rate limiting rules with increasing penalties to manage clients making too many requests.

Rule #1

Setting Value
Matching criteria Hostname equals example.com and URI Path equals /login and Request Method equals POST
Expression http.host eq "example.com" and http.request.uri.path eq "/login" and http.request.method eq "POST"
Counting characteristics IP
Increment counter when URI Path equals /login and Method equals POST and Response code is in (401, 403)
Counting expression http.request.uri.path eq "/login" and http.request.method eq "POST" and http.response.code in {401 403}
Rate (Requests / Period) 4 requests / 1 minute
Action Managed Challenge

Rule #2

Setting Value
Matching criteria Hostname equals example.com and URI Path equals /login and Request Method equals POST
Expression http.host eq "example.com" and http.request.uri.path eq "/login" and http.request.method eq "POST"
Counting characteristics IP
Increment counter when URI Path equals /login and Request Method equals POST and Response Status Code is in (401, 403)
Counting expression http.request.uri.path eq "/login" and http.request.method eq "POST" and http.response.code in {401 403}
Rate (Requests / Period) 10 requests / 10 minutes
Action Managed Challenge

Rule #3

Setting Value
Matching criteria Host equals example.com
Expression http.host eq "example.com"
Counting characteristics IP
Increment counter when URI Path equals /login and Request Method equals POST and Response Status Code is in (401, 403)
Counting expression http.request.uri.path eq "/login" and http.request.method eq "POST" and http.response.code in {401 403}
Rate (Requests / Period) 20 requests / 1 hour
Action Block for 1 day

These example rules require a Business plan or above.

Rule #1 allows up to four requests per minute, after which a Managed Challenge is triggered. This configuration allows legitimate customers a few attempts to remember their password. If an automated actor makes several requests, that client will likely be blocked by an unsolved Managed Challenge. On the other hand, if a human gets and passes the challenge when reaching rule #1's rate limit, rule #2 will provide the next level of protection, allowing for up to 10 requests over the next 10 minutes. For clients exceeding this second threshold, rule #3 (the most severe) will apply, blocking the client for one day.

These three rules have a counting expression separate from the rule expression (also known as mitigation expression). When you configure a separate counting expression, the matching criteria will only be used when an action is triggered. In the counting expression you can include conditions based on the HTTP response status code and HTTP response headers, therefore integrating rate limiting with your backend logic.
…(内容过长已截断)

------
导航页打开网址

Setting	Value
Matching criteria	User Agent equals MobileApp
Expression	http.user_agent eq "MobileApp"
Counting characteristics	IP
Rate (Requests / Period)	100 requests / 10 minutes
Action	Managed Challenge