Cloudflare Rate Limiting

Control to block suspicious visitors

Rate Limiting protects against denial-of-service attacks, brute-force login attempts, and other types of abusive behavior targeting the application layer.

Cloudflare’s 10 Tbps global anycast network is 10X bigger than the largest DDoS attack ever recorded, allowing all internet assets on Cloudflare’s network to withstand even massive DDoS attacks.

Rate Limiting provides the ability to configure thresholds, define responses, and gain valuable insights into specific URLs of websites, applications, or API endpoints. It adds granular HTTP/HTTPS traffic control to complement Cloudflare’s DDoS protection and Web Application Firewall (WAF) solutions. Cloudflare charges based on “good” requests i.e requests that match a rule you have created and are allowed to origin servers. This also reduces bandwidth costs by eliminating unpredictable traffic spikes or attacks.

Start Rate Limiting malicious traffic for free today.

Contact Our Team
UK callers: +44 (0)20 3514 6970
Singapore callers: +65 3158 3954
International callers: +1 (650) 319 8930

Already a Cloudflare customer? Activate Rate Limiting

Shield

Layer 7 DDoS Mitigation

High precision distributed denial-of-service protection through granular configuration options.

API in browser

API Protection

Set API usage limits to ensure availability and protect against abuse.

Browser with cloud icon

Brute Force Protection

Protect sensitive customer information against brute force login attacks.

Lock in front of data

Cost Savings

Avoid unpredictable costs associated with traffic spikes or attacks on auto-scaling resources by only allowing good traffic through.

Rate Limiting ensures I can keep running my service reliably, cost effectively and ethically.
TROY HUNT
Founder at HaveIBeenPwned.com

Rate Limiting in Action

This interactive demo provides three different scenarios on how to utilize rate limiting to protect your endpoints from suspicious requests. Select one of the demos below to see rate limiting in action.

This example demonstrates the ability to limit the number of login attempts. Visitors get 2 login attempts per minute. If they exceed this threshold, the will be denied the ability to login for 5 minutes.

  • Brute Force Login Protection

  • API Abuse Protection

  • High Precision DDoS Protection

Demo: Brute Force Login Protection

Attempt to login more than 2 times in under 1 minute

This example demonstrates the ability to limit the number of login attempts. Visitors get 2 login attempts per minute. If they exceed this threshold, the will be denied the ability to login for 5 minutes.

Login

Demo: API Abuse Protection

Click "Run" to initiate excessive API requests

This example simulates a content scraper programmatically sending requests to an API. With Rate Limiting, we mitigate API service degradation by allowing 10 requests to our endpoint before serving a custom JSON response.

curl -X GET "https://api.cloudflare.com/client/v4/zones/cd7d0123e3012345da9420df9514dad0"
Demo: High Precision DDoS Protection

Refresh the content more than 2 times in under 1 minute

Sophisticated DDoS attacks are difficult to mitigate because they come from a large number of unique IP addresses and mimic legitimate traffic. The demo below uses Rate Limiting to allow up to 2 requests per minute before blocking a potential DDoS attack.

Refreshing... Content loaded successfully. Try refreshing again Request blocked. Try again in 3 minutes

Configure Thresholds

Protect your website URLs or API endpoints from suspicious requests that exceed defined thresholds. Granular configuration options including request limits, requests methods, and more.

Define Responses

Website and API visitors hitting defined request thresholds can trigger custom responses, such as mitigating actions (challenges or CAPTCHAS), response codes (Error 401 - Unauthorized), timeouts, and blocking.

Analytical Insight

Gain deep insights into traffic patterns to help scale and protect your resources. See how much malicious traffic is blocked by rule, how many requests make it to your origin, and more.

Only Pay for Good Traffic. Not Bad.

Cloudflare Rate Limiting can be activated for free. Self-serve plans include 10,000 free requests per month and Enterprise plans allow for unlimited rate limiting. We only charge for good traffic passing through the rate limited endpoints of your website or API. Good traffic means requests that do not exceed your rate limited thresholds.

Requests per IP address matching the traffic pattern.

Rate limiting graph

Already a Cloudflare customer? Activate Rate Limiting

Making the Internet Work the Way It Should for Anything Online

Cloudflare speeds up and protects millions of websites, APIs, SaaS services, and other properties connected to the Internet. Our Anycast technology enables our benefits to scale with every server we add to our growing footprint of data centers.

Performance

Cloudflare is dedicated to enabling the best possible performance for our customers. Our global network speeds up and streamlines connections from visitors to their online destinations in a number of key ways:

  • CDN

    Moving content physically closer to visitors with our CDN is one of easiest way to improve the performance of your website and reduce load on your web servers.
  • Website Optimization

    Cloudflare lets you automatically enable the latest in web technologies. Our web optimization features cover everything from mobile image optimization to aggressive GZIP and HTTP/2.
  • DNS

    Cloudflare is one of the fastest managed DNS providers in the world. The same 115 data center network that powers our CDN dramatically speeds up domain resolution for your website’s visitors.
  • Load Balancing

    Cloudflare Load Balancing provides load balancing, geo-steering, monitoring and failover for your Internet facing infrastructure enhancing service availability.
  • SSL

    Modern SSL isn’t just for security—it can actually improve the performance of your website by leveraging features like OCSP stapling, session resumption, HTTP/2, and TLS 1.3.

Security

As applications move to the cloud, their security needs to move with them. Cloudflare’s security services operate at the edge of the network, making it possible to identify and mitigate threats faster than on-premise solutions.

  • DDoS Protection

    Our enterprise-class DDoS protection network has 20 times more capacity than the largest DDoS attack ever recorded. Operating at the network edge, it protects against all forms of DDoS attacks.
  • WAF

    Our web application firewall benefits from the collective intelligence of our entire network. When we identify a new threat from one website, we can automatically block it from the other 6 million websites on our network.
  • Secure Registrar

    Registering your domain through Cloudflare is the most secure way to protect your trademark from domain hijacking.
  • Dedicated SSL Certificates

    With a few clicks within the Cloudflare dashboard, you can easily and quickly issue new certificates, securely generate private keys and more. Dedicated SSL Certificates are available for purchase on all Cloudflare pricing plans.
  • Rate Limiting

    Rate Limiting gives you granular controls to detect bad traffic, customized rulesets to ensure that your legitimate visitors are not impacted, and insights to improve your security posture as attacks evolve.