Description

Ensure the zone has at least one rate limiting rule that limits how many requests a client can send in a set time to sensitive paths, such as login, sign-up, password reset, and API endpoints. Requests above the limit should be blocked or challenged.

Rationale

Without rate limits, attackers can send unlimited requests to guess passwords, test stolen credentials, scrape content, or overload the application. Rate limiting slows these attacks down by blocking clients that send too many requests, while normal users are not affected.

Impact

  • Slows down brute-force and credential stuffing attacks

  • Reduces scraping and application-layer DoS

  • Limits that are too low can block real users

Default Value

By default, no rate limiting rules are configured. The number of rules and available options depend on your plan.

Pre-Requisites

  • Cloudflare account with Administrator or Firewall permissions for the zone

  • A list of sensitive paths and their normal request rates

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Security rules (on older dashboards, Security > WAF).

  4. Review the Rate limiting rules and verify that at least one active rule protects sensitive paths.

  5. If no active rate limiting rule exists, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Security rules (on older dashboards, Security > WAF).

  4. Select Create rule and choose Rate limiting rules.

  5. Enter a rule name and set the conditions, for example URI Path equals /login.

  6. Under With the same characteristics, keep IP, then set the rate, for example 10 requests per 10 seconds. The available periods depend on your plan.

  7. Under Then take action, choose Block (or Managed Challenge), and set the duration.

  8. Select Deploy.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Security rules (on older dashboards, Security > WAF).

  4. Find the rate limiting rule, turn it off, or delete it.

Reference