导航|地址|刷新
Rate limiting parameters

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

WAF

/

Overview

Get started

Concepts

Traffic detections

Overview

Attack score

Leaked credentials

Overview

Get started

Common API calls

Terraform examples

Example mitigation rules

Malicious uploads

Overview

Get started

Example rules

Common API calls

Terraform examples

AI Security for Apps

Overview

Get started

PII detection

Unsafe and custom topic detection

Prompt injection detection

Token counting

Example mitigation rules

Log mode vs production mode

Available fields

Bot score ↗

Threat intelligence

Overview

Get started

Example rules

Available fields

Custom rules

Overview

Create in the dashboard

Create via API

Create using Terraform ↗

Configure a rule with the Skip action

Overview

API examples

Skip options

Common use cases

Allow traffic from IP addresses in allowlist only

Allow traffic from search engine bots

Allow traffic from specific countries only

Block Microsoft Exchange Autodiscover requests

Block requests by attack score

Block traffic by geographical location

Block traffic from specific countries

Build a sequence rule within custom rules

Challenge bad bots

Configure token authentication

Exempt partners from Hotlink Protection

Issue challenge for admin user in JWT claim based on attack score

Require a specific cookie

Require known IP addresses in site admin area

Require specific HTTP headers

Require specific HTTP ports

Stop R-U-Dead-Yet? (R.U.D.Y.) attacks

Update custom rules for customers or partners

Custom rulesets

Rate limiting rules

Overview

Request rate calculation

Create in the dashboard

Create via API

Create using Terraform ↗

Find appropriate rate limit

Rate limiting parameters

Rule examples

Best practices

Troubleshooting

Managed rules

Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Troubleshooting

Create exceptions

Overview

Add an exception in the dashboard

Add an exception via API

Log the payload of matched rules

Overview

Configure in the dashboard

View the payload content in the dashboard

Configure via API

Store decrypted matched payloads in logs

Command-line operations

Overview

Generate a key pair

Decrypt the payload content

Check for exposed credentialsDeprecated

Overview

How it works

Configure via API

Configure using Terraform

Test your configuration

Monitor exposed credentials events

Upgrade to leaked credentials detection

Rulesets reference

Cloudflare Managed Ruleset

Cloudflare OWASP Core Ruleset

Overview

Concepts

Evaluation example

Configure in the dashboard

Configure via API

Configure in Terraform ↗

Cloudflare Exposed Credentials Check Managed RulesetDeprecated

Cloudflare Sensitive Data Detection

Additional tools

Lists

Overview

Custom lists

Bulk Redirect Lists ↗

Managed Lists

Create in the dashboard

Use lists in expressions

Lists API

Overview

JSON object

Endpoints

IP Access rules

Overview

Create a rule

Parameters

Actions

Scrape Shield

Overview

Email Address Obfuscation

Hotlink Protection

User Agent Blocking

Zone Lockdown

Browser Integrity Check

Enable security.txt ↗

Privacy Pass

Replace insecure JS libraries

Security Level

Validation checks

Account-level configuration

Overview

Custom rulesets

Overview

Use the dashboard

Use the API

Use Terraform ↗

Rate limiting rulesets

Overview

Create in the dashboard

Create via API

Create using Terraform ↗

Managed rulesets

Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Create exceptions ↗

Analytics

Security Analytics

Security Events

Security features interoperability

Reference

Alerts

Phases

Legacy features

WAF managed rules (previous version)

Overview

Troubleshooting

WAF managed rules upgrade

Rate Limiting (previous version)

Overview

Troubleshooting

Rate limiting upgrade

Firewall rules ↗

Firewall rules upgrade

Troubleshooting

Bing's Site Scan blocked by a managed rule

Fake bot detection blocking legitimate requests

Issues sharing to Facebook

SameSite cookie interaction with Cloudflare

Rule phase interactions

FAQ

Glossary

Changelog

Overview

Changelog

Scheduled changes

Historical (2024)

Historical (2023)

Historical (2022)

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

WAF llms.txt ↗

WAF llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/WAF

/Rate limiting rules

/Rate limiting parameters

Rate limiting parameters

Last updated Apr 29, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewParameter reference When incoming requests match Also apply rate limiting to cached assets With the same characteristics Increment counter when When rate exceeds When rate exceeds > Requests When rate exceeds > Period When rate exceeds > Score per period When rate exceeds > Response header name Then take action For duration With the following behaviorNotes about rate limiting characteristics Use cases of IP with NAT support Incompatible characteristics Do not use cf.colo.id as a field in expressions Use a lowercased header name (for API users) Missing field versus empty value Recommended configurations when using Cookie value of Requirements for using claims inside a JSON Web Token (JWT)Configuration restrictions

The available rate limiting rule parameters are described in the following sections.

For more information on the current rule configuration restrictions, refer to Configuration restrictions.

Parameter reference

When incoming requests match

Data type: String

Field name in the API: expression (rule field)

Defines the criteria for the rate limiting rule to match a request.

Also apply rate limiting to cached assets

Data type: Boolean

Field name in the API: requests_to_origin (optional, with the opposite meaning of the Cloudflare dashboard option)

If this parameter is disabled (or when the requests_to_origin API field is set to true), only the requests going to the origin (that is, requests that are not cached) will be considered when determining the request rate.

In some cases, you cannot disable the Also apply rate limiting to cached assets parameter due to configuration restrictions. Refer to Configuration restrictions for details.

Depending on your Cloudflare plan, this rule parameter might not be available. In that case, Cloudflare will also apply rate limiting to cached assets (the parameter is enabled by default).

With the same characteristics

Data type: Array<String>

Field name in the API: characteristics

Set of parameters defining how Cloudflare tracks the request rate for the rule.

Use one or more of the following characteristics:

Dashboard value API value Notes
N/A (implicitly included) cf.colo.id(mandatory) Do not use in expressions
IP ip.src Incompatible with IP with NAT support
IP with NAT support cf.unique_visitor_id Incompatible with IP
Header value of (enter header name) http.request.headers["<header_name>"] Use lowercased header name in API and Missing field versus empty value
Cookie value of (enter cookie name) http.request.cookies["<cookie_name>"] Recommended configurations and Missing field versus empty value
Query value of (enter parameter name) http.request.uri.args["<query_param_name>"] Missing field versus empty value
Host http.host
Path http.request.uri.path
AS Num ip.src.asnum
Country ip.src.country
JA3 Fingerprint cf.bot_management.ja3_hash
JA4 cf.bot_management.ja4
JSON string value of (enter key) lookup_json_string(http.request.body.raw, "<key>") Missing field versus empty value and lookup_json_string() function reference
JSON integer value of (enter key) lookup_json_integer(http.request.body.raw, "<key>") Missing field versus empty value and lookup_json_integer() function reference
Form input value of (enter field name) http.request.body.form["<input_field_name>"] Missing field versus empty value
JWT claim of (enter token configuration ID, claim name) lookup_json_string( http.request.jwt.claims["<token_configuration_id>"][0], "<claim_name>") Requirements for claims in JWT, missing field versus empty value and JWT Validation reference
Body http.request.body.raw
Body size (select operator, enter size) http.request.body.size
Custom (enter expression) Enter a custom expression. You can use a function such as substring() or lower(), or enter a more complex expression. Functions

The available characteristics depend on your Cloudflare plan. Refer to Availability for more information.

Caution

For important details about these characteristics, refer to Notes about rate limiting characteristics.

Increment counter when

Data type: String

Field name in the API: counting_expression (optional)

Only available in the Cloudflare dashboard when you enable Use custom counting expression.

Defines the criteria used for determining the request rate. By default, the counting expression is the same as the rule matching expression (defined in When incoming requests match). This default is also applied when you set this field to an empty string ("").

The counting expression can include HTTP response fields. When there are response fields in the counting expression, the counting will happen after the response is sent.

In some cases, you cannot include HTTP response fields in the counting expression due to configuration restrictions. Refer to Configuration restrictions for details.

The counting expression does not extend the rule expression

If you set a custom counting expression, it will not automatically extend the rule matching expression. Therefore, you may wish to include the matching expression in the counting expression.

For example, you might want to perform rate limiting for clients sending more than five requests to /api/ resulting in a 403 HTTP status code from the origin server. In this case, the matching expression would be starts_with(http.request.uri.path, "/api/") and the counting expression would be http.response.code eq 403 and starts_with(http.request.uri.path, "/api/"). If the counting expression did not include the matching expression (that is, if you had set the counting expression to http.response.code eq 403), any response with a 403 status code on any URL would increase the counter.

When rate exceeds

Field name in the API: N/A (different API fields required according to the selected option)

The rate limiting counting can be:

Request based: Performs rate limiting based on the number of incoming requests during a given period. This is the only counting method when complexity-based rate limiting is not available.

Complexity based: Performs rate limiting based on the complexity or cost of handling requests during a given period. Only available to Enterprise customers with Advanced Rate Limiting.

When rate exceeds > Requests

Data type: Integer

Field name in the API: requests_per_period

The number of requests over the period of time that will trigger the rule. Applies to request-based rate limiting.

When rate exceeds > Period

Data type: Integer

Field name in the API: period

The period of time to consider (in seconds) when evaluating the request rate. The available values vary according to your Cloudflare plan.

The available API values are: 10, 60 (one minute), 120 (two minutes), 300 (five minutes), 600 (10 minutes), or 3600 (one hour).

When rate exceeds > Score per period

Data type: Integer

Field name in the API: score_per_period

Maximum score per period. When this value is exceeded, the rule action will execute. Applies to complexity-based rate limiting.

When rate exceeds > Response header name

Data type: String

Field name in the API: score_response_header_name

Name of HTTP header in the response, set by the origin server, with the score for the current request. Applies to complexity-based rate limiting.

Then take action

Data type: String

Field name in the API: action (rule field)

Action to perform when the rate specified in the rule is reached.

Use one of the following values in the API: block, js_challenge (Non-Interactive Challenge), managed_challenge (Managed Challenge), challenge (Interactive Challenge), or log.

If you select the Block action, you can define a custom response using the following parameters:

With response type

With response code

Response body

With response type (for Block action)

Data type: String

Field name in the API: response > content_type (optional)

Defines the content type of a custom response when blocking a request due to rate limiting. Only available when you set the
…(内容过长已截断)

------
导航页打开网址

Dashboard value	API value	Notes
N/A (implicitly included)	cf.colo.id(mandatory)	Do not use in expressions
IP	ip.src	Incompatible with IP with NAT support
IP with NAT support	cf.unique_visitor_id	Incompatible with IP
Header value of (enter header name)	http.request.headers["<header_name>"]	Use lowercased header name in API and Missing field versus empty value
Cookie value of (enter cookie name)	http.request.cookies["<cookie_name>"]	Recommended configurations and Missing field versus empty value
Query value of (enter parameter name)	http.request.uri.args["<query_param_name>"]	Missing field versus empty value
Host	http.host
Path	http.request.uri.path
AS Num	ip.src.asnum
Country	ip.src.country
JA3 Fingerprint	cf.bot_management.ja3_hash
JA4	cf.bot_management.ja4
JSON string value of (enter key)	lookup_json_string(http.request.body.raw, "<key>")	Missing field versus empty value and lookup_json_string() function reference
JSON integer value of (enter key)	lookup_json_integer(http.request.body.raw, "<key>")	Missing field versus empty value and lookup_json_integer() function reference
Form input value of (enter field name)	http.request.body.form["<input_field_name>"]	Missing field versus empty value
JWT claim of (enter token configuration ID, claim name)	lookup_json_string( http.request.jwt.claims["<token_configuration_id>"][0], "<claim_name>")	Requirements for claims in JWT, missing field versus empty value and JWT Validation reference
Body	http.request.body.raw
Body size (select operator, enter size)	http.request.body.size
Custom (enter expression)	Enter a custom expression. You can use a function such as substring() or lower(), or enter a more complex expression.	Functions