Rate limiting rules in control the rate of incoming requests that match specific conditions. When a client exceeds the configured request threshold, rate limiting enforces actions such as slider CAPTCHA verification or temporary IP blacklisting.
How rate limiting works
Rate limiting identifies and mitigates distributed denial-of-service (DDoS) attacks and HTTP flood attacks by monitoring request rates. You can configure a queries per second (QPS) threshold and matching conditions based on dimensions such as client IP address and user agent. When the threshold is exceeded, rate limiting triggers a predefined action in real time. Available actions include observation, slider CAPTCHA verification, and blocking for 10 seconds to 24 hours.
Availability by plan
Item | Entrance | Pro | Enterprise | |
Rate limiting rules | 1 | 2 | 5 | 10 |
Create a rate limiting rule
The following example walks you through each configuration field and helps you configure a rate limiting rule for your business.
Example scenario: A large number of requests have the host www.example.com or image.example.com, and 20 requests from the same client IP address arrive within 10 seconds. For this type of request, slider CAPTCHA verification runs for 5 minutes. Only requests that pass the slider CAPTCHA verification receive a normal response. All other requests are blocked.
Procedure
In the ESA console, select Websites, and in the Website column, click the target site.
In the left navigation pane, choose .
On the WAF page, select the Rate Limiting Rules tab, click Create Rule, and then enter the rule information based on the on-screen instructions.
Enter a Rule Name.
Configure If requests match... to filter user requests that meet the rule expression. For the request match fields, see Match fields. In this example, select Hostname for the match type field, select is in for the match operator field, and enter
www.example.comandimage.example.comin the match value field.Configure Apply to Cache. Rate limiting reduces the number of requests from clients that share the same characteristics, which lowers the request load on your origin server. However, requests that hit the cache are served directly by ESA and do not reach your origin server. If you do not want rate limiting to apply to cached requests, clear this checkbox.
Configure With the same characteristics... to filter requests that meet the rule expression again.
Configure When the rate exceeds... to set the maximum number of times that the statistical object can match the conditions within the statistical period.
When the action is set to Apply to Matched Requests, the action duration is the same as the statistical period.
WAF counts a request after the response to the request ends. If your traffic contains many large-file requests, the long download times delay the point at which blocking actually starts.
Configure Then execute... to select the action to execute when the request rate reaches the limit. You can apply the action only to requests that exceed the limit, or to all requests that match the characteristics after the limit is exceeded. For more information about the actions, see Actions.
Click OK.
Expected results
All client requests whose host is www.example.com or image.example.com, including requests that hit the cache and all back-to-origin requests, are counted by the source IP address of the request. If more than 20 requests arrive within 10 seconds, slider CAPTCHA verification runs on all of these requests for 5 minutes.
