Rate Limiting
Rate Limiting is a rule action in Console → WAF → [your domain] → Rules. Create a rule, set your match conditions, and choose the Rate Limit action. Configure the request threshold and time window (in seconds). When the limit is exceeded, the configured action (block or challenge) is applied to that IP.
Configuration options
Section titled “Configuration options”The Rate Limit action counts requests by source IP within a time window you define. Use rule conditions to scope which traffic the limit applies to:
- Path: apply the limit only to a specific endpoint (e.g.
/login) - Method: limit only POST requests on a form endpoint
- Country or ASN: apply stricter limits to specific regions
- Any combination of conditions the rule engine supports
Failban
Section titled “Failban”Failban is an automatic IP ban triggered by repeated rule matches within a time window. For example: if an IP triggers the login rate limit 5 times in 10 minutes, ban it for 1 hour. The ban is lifted automatically when the TTL expires. No manual intervention needed.
Use cases
Section titled “Use cases”Rate limiting covers a wide range of abuse scenarios:
- Login endpoint: 5 attempts per IP per minute, then challenge
- Registration form: 3 submissions per IP per hour
- API endpoints: 100 requests per token per minute
- Search or scraping protection: 30 requests per IP per minute on
/search - Brute-force on admin paths: failban after 3 failures in 5 minutes