Advanced Rate Limiting

Cloudflare Rate Limiting protects applications and APIs from various types of abuse, especially denial-of-service (DoS) attacks, brute-force login attempts, and malicious requests, by controlling the amount of traffic from suspicious sources.

Rate Limiting defends against layer 7 DDoS attacks through granular configuration options, throttling traffic from unauthenticated endpoints and allowing customers to set usage limits. It also protects customer data by thwarting brute-force login attempts aimed at taking over user accounts and stealing sensitive information.

Rate Limiting helps ensure API availability by identifying and throttling abusive traffic. Advanced Rate Limiting allows customers to control traffic based on any parameter of a request, which helps protect against volumetric attacks from authenticated API sessions.

Customers can define custom responses for users who hit the request thresholds. These responses can include issuing a challenge or CAPTCHA, returning a specific response code, initiating a timeout, or blocking the request entirely.

Cloudflare never charges for usage spikes that occur due to an attack.

Cloudflare Rate Limiting provides analytics that give you insight into traffic patterns, including the amount of malicious traffic that has been blocked by your rules and the number of requests that are reaching your origin server.