Cloudflare Rate Limiting Rules

Edge rate limiting by IP, path, header, or ASN with sliding window and custom actions.

CloudflareBeginner

Why

Rate limiting at the edge stops abuse before origin — protects login, API, and expensive endpoints. Free plan includes 10k rules, no origin code needed.

Sliding window is more accurate than fixed window.

When

Use for login throttling, API quota, signup abuse prevention, and expensive search endpoints. Avoid for per-user limits needing DB state (use Durable Objects).

How

1. Dashboard — Security → WAF → Rate limiting rules → Create 2. Match — URL path, HTTP method, header value, source IP/ASN 3. Limit — requests (count) per period (seconds), sliding window 4. Action — block (429), challenge (JS check), log, or managed_challenge 5. Duration — how long to block after threshold (e.g. 600s) 6. Characteristic — count by IP, IP+path, or custom (e.g. cf-IPcountry) 7. Deploy — instant, applies to all edge locations

Example

# Rate limit: 10 login attempts per minute per IP resource "cloudflare_ruleset" "rl_login" { zone_id = var.zone_id name = "login-rate-limit" kind = "zone" phase = "http_ratelimit" rules { action = "block" ratelimit { characteristics = ["ip.src"] period = 60 requests_per_period = 10 mitigation_timeout = 600 } expression = "(http.request.uri.path eq "/login" and http.request.method eq "POST")" } } // Worker-side per-user rate limit via Durable Object export class RateLimiter implements DurableObject { async fetch(request: Request) { const now = Date.now(); const times = (await this.ctx.storage.get<number[]>("times") || []).filter(t => now - t < 60000); if (times.length >= 10) return new Response("Too many", { status: 429 }); times.push(now); await this.ctx.storage.put("times", times); return new Response("OK"); } }

Common Problems

⚠Behind NAT, all users share IP — rate limit by header (X-User-Id) not IP for mobile/enterprise
⚠Sliding window vs fixed — fixed window allows 2x burst at boundary, use sliding
⚠Block duration too short — abusers retry immediately, set 600s+ for login

Best Practices

✓Use managed_challenge not block — JS check filters bots, lets real users through
✓Layer edge + origin limits — edge for IP, origin (Durable Object) for per-user
✓Monitor 429 spikes — sudden increase may indicate attack or broken client

FAQ

What is Cloudflare Rate Limiting Rules and what problem does it solve?

Edge rate limiting by IP, path, header, or ASN with sliding window and custom actions. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Cloudflare Rate Limiting Rules in 5 minutes?

Two steps to run it: (1) Dashboard — Security → WAF → Rate limiting rules → Create; (2) Match — URL path, HTTP method, header value, source IP/ASN. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Cloudflare Rate Limiting Rules?

The most frequent issue is: Behind NAT, all users share IP — rate limit by header (X-User-Id) not IP for mobile/enterprise. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Cloudflare Rate Limiting Rules?

Best practices for Cloudflare Rate Limiting Rules include: Use managed_challenge not block — JS check filters bots, lets real users through; Layer edge + origin limits — edge for IP, origin (Durable Object) for per-user; Monitor 429 spikes — sudden increase may indicate attack or broken client. The first one — "Use managed_challenge not block — JS check filters bots, lets real users through" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Cloudflare Rate Limiting Rules?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Cloudflare Rate Limiting Rules options offer a free tier — validate within free quota before scaling.