What it is
Rate Limiting protects specific endpoints from abuse by capping how many requests a client can make in a time window. It's ideal for login pages, APIsAPIApplication Programming Interface — how software talks to other software, e.g. a mobile app calling a server., and expensive operations — shutting down brute-force, credential stuffingcredential stuffingUsing stolen username/password lists to try to break into many accounts at once., and scraping without affecting normal users.
Why it helps the client
- Stops brute-force logins and credential stuffing at the edge.
- Shields expensive endpoints — search, checkout, APIs — from being hammered.
- Protects origin capacity and databases from abusive spikes.
- Granular matching by path, method, header, or IP, with your choice of action.
Why they'd want it
- Prevent account takeover and API abuse cheaply and instantly.
- Keep the origin healthy under attack or accidental traffic storms.
- Define rules in the dashboard in under a minute — no code.
🔬 How it actually works
- Rate Limiting rules live inside the WAFWAFWeb Application Firewall — inspects web requests and blocks malicious ones (like SQL injection and XSS) before they reach your site.. Each rule counts requests matching an expression over a time window, keyed by IPIP addressA numeric address that identifies a device or server on the Internet., header, cookie, JA3, or a custom characteristic, and applies an action when the threshold is crossed.
- It runs distributed at the edgethe edge“The edge” means Cloudflare's servers spread across the world, close to your users — as opposed to one central data center., counting close to users but aggregating to enforce a global limit — ideal for login brute-force, OTP/SMS abuse, APIAPIApplication Programming Interface — how software talks to other software, e.g. a mobile app calling a server. quotas, and expensive endpoints like search or checkout.
- Actions are block, managed challenge, or log, applied for a configurable mitigation timeout. Advanced Rate Limiting (Enterprise) adds counting by response fields and complex composite keys.
- Because it's expression-based, you can scope a limit to exactly one endpoint and one client dimension without affecting the rest of the site.
📖 Key terms on this page hover any underlined term anywhere on the site for its definition
- origin
- Your own web server or host where your website actually lives. Cloudflare sits in front of it.
- API
- Application Programming Interface — how software talks to other software, e.g. a mobile app calling a server.
- credential stuffing
- Using stolen username/password lists to try to break into many accounts at once.
- the edge
- “The edge” means Cloudflare's servers spread across the world, close to your users — as opposed to one central data center.
- IP address
- A numeric address that identifies a device or server on the Internet.
- WAF
- Web Application Firewall — inspects web requests and blocks malicious ones (like SQL injection and XSS) before they reach your site.
- DDoS
- Distributed Denial of Service — an attack that floods a site with junk traffic from many sources to knock it offline.
- bot
- Automated software making requests instead of a human. Some bots are good (search engines); many are malicious.
Live demo walkthrough
5 stepsScreens below are annotated recreations of the Cloudflare dashboard. The numbered orange pin marks exactly where to click.
Select the website
Websites
Select a website to manage its configuration.
👉 Do this
Open the site with the endpoint you want to protect.
💬 Say this
“Let's protect a high-value endpoint — the login page — from brute-force abuse.”
Open the Rate limiting rules tab
Security
WAF
👉 Do this
Go to Security → WAF, then click the 'Rate limiting rules' tab.
💬 Say this
“Rate limiting lives inside the WAF. I'll open the Rate limiting rules tab — this is where we set thresholds per endpoint.”
Create a rule
Security
WAF › Rate limiting rules
👉 Do this
Click 'Create rule' and match the endpoint (e.g. URI Path equals /login).
💬 Say this
“We create a rule that matches just the login endpoint. Everything else on the site is unaffected.”
Set the threshold and action
Security
WAF › Rate limiting rules
👉 Do this
Set 10 requests / minute per IP, action Block for 10 minutes.
💬 Say this
“We say: more than 10 requests to /login in a minute from the same IP, block that IP for ten minutes. Brute-force is dead on arrival, and legitimate users never notice.”
Watch it work in Events
Security
Events
👉 Do this
Open Events and filter to the rate-limiting action on /login.
💬 Say this
“Minutes after going live, the throttle shows up in Events — login attempts from the same IP blocked, origin untouched. That log is exactly what a security team wants for their brute-force runbook.”