Skip to main content

Rate limiting

Rate limiting caps requests per second on a path or source CIDR at the scrubbing edge. Use it when a listener must stay open but should not accept unlimited clean-looking floods.

The heading line is Cap requests per second on a path or source CIDR at the scrubbing edge.

When to use it​

  • A game, login, or voice path must remain reachable, but a flood still consumes your clean budget
  • You want a ceiling per path or per source CIDR
  • Default mitigation is working, yet one listener is still hotter than the rest of the host

Do not use rate limiting as the first response to "the site is down" if Attacks is empty. Fix routing first.

Add a policy​

  1. Open Rate limiting. Confirm the service window is open.

  2. Under Add rate-limit policy, set:

    FieldWhat it does
    NameLabel you will recognize later (for example Login limiter)
    Path or CIDRA path such as /login, or a source prefix such as 203.0.113.0/24
    Requests / secThe sustained cap
    BurstShort-term allowance above the cap

  3. Click Add policy.

  4. Confirm the row under Policies: Name, Match, Limit (for example 50/s - burst 100), Status (Active), Applied.

Each policy has Edit and Remove.

After you save​

Wait for Changes applying on Overview to return to 0. Watch Attacks and the origin. If legitimate users stall, raise the limit or remove the policy. Do not stack extra policies to paper over a bad match.

Rate limiting vs the quote​

A rate limit does not raise quoted clean Mbps. It shapes what is allowed through within that budget. The invoice still follows 95th-percentile clean bandwidth.

If you need a limit the form cannot express, open a Ticket or write [email protected].