Cloudflare Rate Limiting — Edge-Level API Protection with WAF Rules

In this tutorial, you will learn about Cloudflare Rate Limiting. We cover key concepts, practical examples, and best practices to help you master this topic.

Cloudflare rate limiting uses the global edge network to enforce rate limits before traffic reaches your origin server, providing protection against DDoS attacks, credential stuffing, and traffic spikes at the network edge.

What You'll Learn

• How Cloudflare rate limiting works at the edge
• How to configure rate limiting rules in the Cloudflare dashboard
• How to use Cloudflare WAF for advanced rate limiting

Why It Matters

Rate limiting at the edge blocks malicious traffic before it consumes your server resources. Cloudflare processes requests in 330+ data centers worldwide, absorbing traffic spikes at the edge and sending only legitimate traffic to your origin.

Real-World Use

DodaTech's API behind Cloudflare uses three rate limiting rules: 100 req/min per IP for /api/*, 5 req/min per IP for /api/auth/login, and 1000 req/min total per account. When a DDoS attack hits, Cloudflare absorbs the traffic at the edge and only legitimate requests reach the API servers.

flowchart LR
    A["Attacker\n10,000 req/s"] --> B["Cloudflare\nEdge Network"]
    C["Legitimate\nUser"] --> B
    B --> D{"Rate Limit\nRule Check"}
    D -->|"Over limit"| E["Block at Edge\n429 response"]
    D -->|"Within limit"| F["Origin\nServer"]
    style B fill:#dbeafe,stroke:#2563eb
    style E fill:#fecaca,stroke:#dc2626
    style F fill:#bbf7d0,stroke:#16a34a

Rate Limiting Rule Configuration

Using Cloudflare API to create rate limit rules:

import requests

CLOUDFLARE_EMAIL = "admin@dodatech.com"
CLOUDFLARE_API_KEY = "your-api-key"
ZONE_ID = "your-zone-id"

headers = {
    "X-Auth-Email": CLOUDFLARE_EMAIL,
    "X-Auth-Key": CLOUDFLARE_API_KEY,
    "Content-Type": "application/json"
}

# Create a rate limiting rule
rate_limit_rule = {
    "description": "API general rate limit - 100 req/min per IP",
    "expression": "(http.request.uri.path starts with \"/api/\")",
    "action": "block",
    "ratelimit": {
        "characteristics": ["ip.src"],
        "period": 60,
        "requests_per_period": 100,
        "mitigation_timeout": 300,
        "mitigation_expression": ""
    }
}

response = requests.post(
    f"https://api.cloudflare.com/client/v4/zones/{ZONE_ID}/rulesets/rate_limit",
    headers=headers,
    json=rate_limit_rule
)
print(response.json())

Cloudflare WAF for Advanced Limiting

# Create a WAF custom rule with rate limiting
waf_rule = {
    "description": "Block credential stuffing - auth endpoint",
    "expression": (
        "(http.request.uri.path eq \"/api/auth/login\") and "
        "(http.request.method eq \"POST\")"
    ),
    "action": "managed_challenge",
    "ratelimit": {
        "characteristics": ["ip.src", "cf.client.bot"],
        "period": 60,
        "requests_per_period": 10,
        "mitigation_timeout": 600,
        "mitigation_expression": ""
    }
}

Cloudflare Headers

Cloudflare adds headers that your backend can use for additional rate limiting:

from flask import Flask, request

app = Flask(__name__)

@app.route('/api/data')
def api_data():
    # Cloudflare-provided headers for rate limiting decisions
    country = request.headers.get('CF-IPCountry')
    connecting_ip = request.headers.get('CF-Connecting-IP')
    threat_score = request.headers.get('cf-threat-score')
    bot_score = request.headers.get('cf-bot-score')

    # Use bot score for additional rate limiting
    if bot_score and int(bot_score) < 30:
        # Likely a bot - apply stricter limits
        apply_strict_rate_limit(connecting_ip)

    return jsonify({"data": "response"})

Common Mistakes

1. Not Testing Rate Limit Rules Before Enabling

Test rules in simulation mode first. A misconfigured rule can block all legitimate traffic.

2. Using Too Broad Expressions

A rule matching /api/ also matches /api-internal/. Use precise path expressions.

3. Not Setting Mitigation Timeout

Without mitigation timeout, a blocked IP stays blocked indefinitely until the rule expires. Set a reasonable timeout (10-60 minutes).

4. Ignoring Bot Scores

Cloudflare provides bot scores. Use them to apply different limits to human traffic vs automated traffic.

5. Not Monitoring Rate Limit Events

Cloudflare analytics shows rate limit events. Monitor the dashboard weekly to tune rules.

Practice Questions

1. Where does Cloudflare enforce rate limits?
2. What is a characteristic in Cloudflare rate limiting?
3. How do you test a rule before enabling it?
4. What Cloudflare header indicates bot traffic?
5. What is mitigation timeout?

Answers

1. At the edge network (330+ data centers). 2. The request attribute used to track rate (e.g., IP, country, ASN). 3. Use simulation mode in the Cloudflare dashboard. 4. cf-bot-score header. 5. How long a client remains blocked after hitting the rate limit.

Challenge

Build a Cloudflare rate limit configuration script that creates rules for different API paths with appropriate limits, sets up WAF custom rules for authentication endpoints, configures bot score-based rate limiting, and sets up email alerts for rate limit events.

FAQ

Mini Project

Create a Cloudflare rate limiting setup script that configures rules for: general API (100 req/min), auth endpoints (5 req/min), search endpoints (30 req/min), and Websocket connections (10 conn/min). Include WAF custom rules for bot mitigation and a monitoring dashboard setup with Cloudflare Analytics API.

What's Next

• Learn about AWS API Gateway rate limiting and usage plans
• Explore Kong API Gateway rate limiting plugin
• Continue to distributed rate limiting with Redis cluster