Rate Limiting Your Login Page

The most targeted way to protect your login page against brute-force attacks is a rule-based Rate Limit action applied only to the login path. For broader protection, combine it with Failban and the Global Rate-Limit.

Recipe A: Rule-based rate limit (recommended)

Limits only the login endpoint; the rest of the site is unaffected.

1. Follow Console → WAF → [domain] → Rules → New Rule.

2. Combine two conditions with Add Condition (AND):

   • Field: Path (without query) (http.request.base_uri) · Operator: equals (==) · Value: /login
   • Field: HTTP Method (http.request.method) · Operator: equals (==) · Value: POST

3. Select Rate Limit as the action and set the parameters:

   • Request count: 5 — requests allowed within the window (1–100000)
   • Window (expire): 60 seconds — counting window (5–600 s)
   • IPv6 prefix: default /64

   # 5 POSTs per IP per minute on the login endpoint
   IF   http.request.base_uri == /login
   AND  http.request.method == POST
   THEN ratelimit count=5 expire=60

4. Save. IPs exceeding the limit receive 429 Too Many Requests for the rest of the window.

Choosing a threshold

A real user doesn’t attempt more than 5 logins per minute; password manager users log in on the first try. 5 requests / 60 seconds is a safe starting point for most sites. For API logins, raise the threshold based on your client behavior.

Recipe B: Banning repeat offenders with Failban

Failban automatically bans IPs that repeatedly produce failures within a short window. Rate limiting slows attackers down; Failban removes them entirely.

1. Open Console → WAF → [domain] → WAF (Protection).

2. In the Fail Ban section, turn on the Enabled switch.

3. Adjust the sliders:

   • Threshold: 5 (5–500) — failures within the window
   • Window: window length, in seconds (1–60 s)
   • Block Time: default 600 seconds (60–86400 s) — how long the ban lasts
   • IPv6 Prefix: default /64

4. Each setting applies the moment it changes; there is no separate save button. Banned IPs are released automatically when the block time expires.

Recipe C: Global Rate-Limit

A general safety net applied to the entire domain, counting every request. It is not login-specific; it stops IPs flooding the whole site.

1. On Console → WAF → [domain] → WAF (Protection), go to the Global Rate-Limit section.

2. Turn on Enabled and configure:

   • Request Count: default 100 (1–6500)
   • Window: window length, in seconds (1–60 s)
   • IPv6 Prefix: default /64

Which method when?

Method	Scope	When
Rule-based rate limit	Only traffic matched by the rule	Specific endpoints like login, signup, search
Failban	Domain-wide, failure producers	Removing repeat attackers entirely
Global Rate-Limit	Domain-wide, all requests	General safety net, flood protection

All three can be used together: the rule-based limit protects the login, limit violations feed the Failban counter, and the global limit covers everything else.

Verification

• Send 6 consecutive POSTs to the login page within one minute (e.g. with curl); the 6th request should return 429.
• Check that the rule’s hit counter is increasing on the Rules page.
• If Failban is enabled, verify that your test IP gets banned after exceeding the threshold and is released automatically when the block time expires.

Related Pages

Rate LimitingRate limit action and Failban concepts