Guide · Security
Cloudflare Rate Limiting for APIs
Add rate limiting to your API with Cloudflare. No code changes—configure rules at the edge.
Edge rate limiting is evidence toward abuse controls and spend ceilings. Primary control: Cost Optimization
Kill scrapers before they hit origin
Cloudflare rate limiting runs at the edge. Abusive clients never reach your app servers or Lambda bill. A docs site proxying search saw CPU climb under a university scraper farm; a rule of ~100 req/min/IP on `/api/search*` cut most of the volume in minutes—no deploy.
Anatomy of a useful rule
Match the API path (`/api/*` or the hot endpoint), set a threshold (start ~100–500 req/min per IP), and prefer block for APIs (challenge helps browsers more than machine clients). Add bypasses for office, CI, and partner CIDRs so you don't lock yourself out while testing.
Log-only for a day if you're nervous; then switch to block once false positives look quiet.
What edge limits don't replace
IP limits help a lot and fail against distributed bots or authenticated abuse on a single key. Keep origin or API Gateway quotas per user/key. Cloudflare is the cheap first filter; identity-aware limits are the second.
APRF Infrastructure treats edge throttles as part of public-surface hardening—use them with authentication and secrets hygiene, not instead of them.
Next: Cost Optimization
Open the related pillar specification for mandatory checks, artifacts, and pass conditions. Self-attest is optional.
Related
Frequently asked questions
- How do I add Cloudflare rate limiting to my API?
- Go to Security > WAF > Rate limiting rules. Create a rule that matches your API path. Set a threshold (e.g., 100 req/min per IP). Choose block or challenge action.
- Does Cloudflare rate limiting require code changes?
- No. Cloudflare enforces rate limiting at the edge. Configure rules in the dashboard. No deployment or code changes required.
- What rate limit should I use for an API?
- Start with 100-500 requests per minute per IP. Adjust based on typical usage. Too low blocks legitimate users; too high doesn't stop abuse.