Rate limiting rules
Rate limiting rules allow you to define rate limits for requests matching an expression, and the action to perform when those rate limits are reached.
Rule parameters
Like other rules evaluated by Cloudflare’s Ruleset Engine, rate limiting rules have an associated expression and an action.
The expression specifies the criteria you are matching traffic on using the Rules language. The action specifies what to perform when there is a match for the rule and any additional conditions are met. In the case of rate limiting rules, the action occurs when the rate reaches the specified limit.
Besides these two parameters, rate limiting rules require the following additional parameters:
- Characteristics — The set of parameters that define how Cloudflare tracks the rate for this rule.
- Period — The period of time to consider (in seconds) when evaluating the rate.
- Requests per period — The number of requests over the period of time that will trigger the rate limiting rule.
- Mitigation timeout — Once the rate is reached, the rate limiting rule blocks further requests for the period of time defined in this field.
Refer to Rate limiting parameters for more information on mandatory and optional parameters.
Refer to Determining the rate to learn how Cloudflare uses the parameters above when determining the rate of incoming requests.
Important remarks
Rate limiting rules are not designed to allow a precise number of requests to reach the origin server. In some situations, there may be a delay (up to a few seconds) between detecting a request and updating internal counters. Due to this delay, excess requests could still reach the origin server before Cloudflare enforces a mitigation action (such as blocking or challenging) in our global network.
Applying rate limiting rules to verified bots might affect Search Engine Optimization (SEO). For more information, refer to Improve SEO.
Availability
Rate limiting rules are available to all customers. Enterprise customers require a separate add-on.
The available features depend on the exact plan:
| Feature | Free | Pro | Business | Enterprise with WAF Essential | Enterprise with Advanced Rate Limiting |
|---|---|---|---|---|---|
| Available fields in rule expression | Path, Verified Bot | Host, URI, Path, Full URI, Query, Verified Bot | Host, URI, Path, Full URI, Query, Method, Source IP, User Agent, Verified Bot | Standard fields, request header fields, dynamic fields (including Verified Bot), other Bot Management fields1 | Standard fields, request header fields, dynamic fields (including Verified Bot), other Bot Management fields1, request body fields2 |
| Counting characteristics | IP | IP | IP | IP, IP with NAT support | IP, IP with NAT support, Query, Host, Headers, Cookie, ASN, Country, Path, JA3 Fingerprint1, JSON body field2, Body2 |
| Available fields in counting expression | N/A | N/A | All rule expression fields, Response code, Response headers | All rule expression fields, Response code, Response headers | All rule expression fields, Response code, Response headers |
| Counting model | Number of requests | Number of requests | Number of requests | Number of requests | Number of requests, complexity score |
| Counting periods | 10 s | 10 s, 1 min | 10 s, 1 min, 10 min | 10 s, 1 min, 2 min, 5 min, 10 min | 10 s, 1 min, 2 min, 5 min, 10 min, 1 h |
| Timeout periods | 10 s | 10 s, 1 min, 1 h | 10 s, 1 min, 1 h, 1 day | 10 s, 1 min, 2 min, 5 min, 10 min, 1 h, 1 day | 10 s, 1 min, 2 min, 5 min, 10 min, 1 h, 1 day |
| Number of rules | 1 | 2 | 5 | 100 | 100 |
1 Only available to Enterprise customers who have purchased Bot Management.
2 Availability depends on your WAF plan.
For availability information related to the previous version of rate limiting rules, refer to Rate Liming allowances per plan.
Next steps
You can configure rate limiting rules at the zone level and at the account level, depending on your plan and product subscriptions.
To configure rate limiting rules in the Cloudflare dashboard, refer to the following resources:
- Create rate limiting rules in the dashboard for a zone
- Create rate limiting rules in the dashboard for an account
You can also configure rate limiting rules using the Rulesets API. Refer to Create rate limiting rules via API for more information.