Configure Cloudflare rate limiting like a pro with a handy guide by our experts. 

At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Services.

Let’s take a look at how our Support Team is ready to help customers with configuring Cloudflare rate limiting

How to configure Cloudflare rate limiting

Cloudflare Rate Limiting is responsible for identifying and mitigating excessive request rates for an entire domain or specific URLs. Each Cloudflare data center has its own Request Rate value.

It is put to use Brute-force attack protection, DDoS protection, in addition to limiting access to API calls, forum searches, or resources that consist of database-intensive operations at the origin.

After an IPv6 /64 IP range or an individual Ipv4 address exceeds the rule threshold, it causes further requests to the origin web server to get blocked with an HTTP 429 response. Furthermore, the response includes a Retry-After header that indicates when the client can restart sending requests.

Moreover, known Search Engine crawlers and cached resources are exempt from a customer’s Rate Limiting rules. Additionally Rate Limiting does not have the power to negatively affect the SEO ranking of a website.

Today, our Support Team is going to demonstrate how to configure the Cloudflare Rate Limiting in order to protect the website application from DDoS attacks, brute-force logins, brutal attacks as well as other abusive behaviors. In other words, we will be taking a look at the following components of Cloudflare rate limiting:

• Analytics
• Rate Limiting allowances per plan
• Components of a Rate Limiting rule
• Identify rate-limit thresholds

Analytics

We can view the Rate Limiting analytics under the Security tab in the Cloudflare Analytics app. This feature utilizes solid lines and dotted lines to exhibit traffic and blocked requests respectively.

Furthermore, logs as a result of a Rate Limiting rule are visible only to the Enterprise customers through Cloudflare Logs.

Blocked requests receive an HTTP 429 error via Cloudflare. However, we can access the details of these requests per location under the Status Codes analytics in the Traffic section.

According to our Support Techs, HTTP 429 error factors in responses from the origin in case of the origin web server applies its own rate-limiting as well.

Additionally, Rate Limiting is an add-on service in the Firewall app under the Tools tab in the Cloudflare dashboard.

Components of a Rate Limiting rule

A Rate Limiting rule is made up of three distinctive components as seen below:

1. Request matching criteria

   Processing of the incoming requests take place according to:

   • Request path:

     This is case sensitive and patterns cannot match the content after anchors or query strings. The asterisk matches any character sequence, including an empty sequence. For instance: A request for example.com/path/ is not the same as example.com/path. However, the homepage example.com has an exception and matches example.com/.
   • Request scheme:

     HTTPS or HTTP. In case both are matches and none is specified, the rule will list _ALL_.
   • Origin response code:

     This is an optional matching criterion.
   • Request method:

     POST or GET. If all methods are matched, none is specified and the rule will list _ALL_.

2. Rate matching criteria:

   A rule has the ability to match the time period and number of all requests from the same client:

   • Number of requests: Mention at least two requests. In the case of single request blocking, the path should be unavailable. For instance, configure the origin web server to return a 403 error.
   • Request period:A rule triggers if a client’s requests exceed a specific duration threshold.
3. Rule mitigation: It pertains to the following:
   • Mitigation action:

     The Rate limit action depends on the domain plan:

     • Block
     • Legacy CAPTCHA
     • JS Challenge
     • Log
   • Ban duration:

     If the timeout is shorter than the threshold, it results in the API automatically increasing the timeout to the same value as the threshold.

Identify rate-limit thresholds

Divide twenty fours hours of uncached website requests by visitors during the same 24 hours will give us the general threshold for Cloudflare Rate Limiting. Next, we have to divide an estimation of the average minutes of a visit. After that, multiply by four to get an estimation of the threshold per minute for the website.

A value higher than four is good since attacks are usually of a higher magnitude than usual typical traffic rates.

According to our Support Techs, we can identify URL rate limits for particular URLs by using 24 hours of uncached requests as well as unique requests. Furthermore, we can adjust thresholds according to the user reports and our monitoring.

[Looking for a solution to another query? We are just a click away.]

Conclusion

In brief, our skilled Support Engineers at Bobcares demonstrated how to configure Cloudflare rate limiting