# Ensure Rate limiting is configured for the zone

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787216620421-ensure-rate-limiting-is-configured-for-the-zone
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the zone has at least one rate limiting rule that limits how many requests a client can send in a set time to sensitive paths, such as login, sign-up, password reset, and API endpoints. Requests above the limit should be blocked or challenged.

**Rationale**

Without rate limits, attackers can send unlimited requests to guess passwords, test stolen credentials, scrape content, or overload the application. Rate limiting slows these attacks down by blocking clients that send too many requests, while normal users are not affected.

**Impact**

-   Slows down brute-force and credential stuffing attacks
    
-   Reduces scraping and application-layer DoS
    
-   Limits that are too low can block real users
    

**Default Value**

By default, no rate limiting rules are configured. The number of rules and available options depend on your plan.

**Pre-Requisites**

-   Cloudflare account with Administrator or Firewall permissions for the zone
    
-   A list of sensitive paths and their normal request rates
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Security rules (on older dashboards, Security > WAF).
    
4.  Review the Rate limiting rules and verify that at least one active rule protects sensitive paths.
    
5.  If no active rate limiting rule exists, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Security rules (on older dashboards, Security > WAF).
    
4.  Select Create rule and choose Rate limiting rules.
    
5.  Enter a rule name and set the conditions, for example URI Path equals /login.
    
6.  Under With the same characteristics, keep IP, then set the rate, for example 10 requests per 10 seconds. The available periods depend on your plan.
    
7.  Under Then take action, choose Block (or Managed Challenge), and set the duration.
    
8.  Select Deploy.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Security rules (on older dashboards, Security > WAF).
    
4.  Find the rate limiting rule, turn it off, or delete it.
    

**Reference**

-   [https://developers.cloudflare.com/waf/rate-limiting-rules/](https://developers.cloudflare.com/waf/rate-limiting-rules/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.