Configure rate limiting and custom rules to protect your critical business APIs, such as login, registration, and payment endpoints. These strategies effectively defend against automated attacks like brute-force attacks, malicious scraping, and DDoS, ensuring the security and stability of your core services.
Background
The core value of web applications lies in their business APIs, such as user authentication, payment transactions, and data exchange. These APIs are primary targets for attackers seeking to steal high-value data and cause direct financial loss. Automated attacks targeting these endpoints (such as credential stuffing, brute-force attacks, sms pumping, and API abuse) not only threaten user data security but can also lead to financial loss and business disruption.This solution addresses the following challenges:
Account security: Prevent mass account takeovers caused by credential stuffing and brute-force attacks.
Financial protection: Stop malicious abuse of resource-intensive endpoints like SMS, email, and coupon services to avoid direct financial loss.
Business stability: Protect core APIs from being overwhelmed by malicious scrapers or attackers, ensuring business continuity and quality of service (QoS) for legitimate users.
Data security: Prevent large-scale, malicious scraping of core business data.
Use cases
User login API: Attackers use automated tools with large dictionaries of breached credentials to make high-frequency login attempts (credential stuffing).
SMS verification API: Attackers repeatedly call this endpoint, draining SMS credits and harassing users (sms pumping).
Core data API: Competitors or malicious scrapers frequently scrape core data, such as product information and pricing, leading to data leakage and high server resource consumption.
Procedure
Configure rate limiting rules
A rate limiting rule is a key mechanism to protect your business APIs from automated abuse. By limiting the request rate from a single client within a specific time window, you can mitigate attacks and prevent backend service overload.
Only Pro and higher plans support rate limiting rules.
API abuse protection
In the ESA console, select Websites, and in the Website column, click your target site.
In the left-side navigation pane, choose .
On the WAF page, select the Rate Limiting Rules tab and click Create Rule. Configure the rule with the following logic: For core APIs, when a single client IP makes more than 100 requests in 60 seconds, block the requests from that IP that exceed the threshold during that window.
For Rule Name, enter a descriptive name, such as
Prevent-Core-API-Abuse.In the If requests match... section, select URI Path for the match field, select is in for the match operator, enter the URL path of the core API (excluding parameters) for the match value, select Case-insensitive, and select Apply to Cache.
NoteA URI path is the part of a URL that identifies a resource. It does not include the protocol, host, or parameters. For example, for the URL
https://example.com/blog/posts/123?page=123, the URI path is/blog/posts/123.For With the same characteristics..., select client IP.
Set When the rate exceeds... to 100 times in 60 seconds (you can adjust this value as needed).
For Then execute..., select Apply to Matched Requests and Block. For the response block page, select Default Error Page.
Click OK. The core API anti-scraping protection is created and takes effect.
Prevent brute-force attacks on login interfaces
In the ESA console, select site management. In the Website column, click the target site.
In the navigation pane on the left, choose .
On the WAF page, select the Rate Limiting Rules tab, and then click Create Rule. The rule is as follows: For login and registration interfaces, if the same IP address makes more than 20 calls in 60 seconds, issue a JavaScript challenge for all login and registration requests from that IP address within that 60-second period. The JavaScript challenge lasts for 5 minutes.
Enter a Rule Name, such as
Login and Registration Interface Rate Limiting.In the If requests match... section, select URI Path for the match field and is in for the match operator. For the match value, enter the URL paths of your core APIs without parameters. Select Case-insensitive and select the Apply to Cache checkbox.
NoteA URI path is the part of a URL that identifies a resource. It does not include the protocol, host, or parameters. For example, for the URL
https://example.com/blog/posts/123?page=123, the URI path is/blog/posts/123.For With the same characteristics..., select Client IP.
For When the rate exceeds..., select 20 times in 60 seconds. Adjust this value as needed.
For the Then execute... action, select Apply to All Requests and JavaScript Challenge, and set the duration to 5 minutes.
Click OK. The protection rule against brute-force attacks on the login interface is created and takes effect.
Configure a custom rule to block common scripts
Custom rules offer a wide range of match conditions and actions. Match conditions include IP addresses, User-Agent, URL paths, and HTTP methods. You can customize these conditions to create Web Application Firewall (WAF) rules that fit your business needs.
In the ESA console, select site management. In the Website column, click the target site.
In the navigation pane on the left, select .
Click the Custom Rules tab. On the Custom Rules tab, click Create Rule. The rule is as follows: if the
User-Agentin the requestHeadercontains any of the following values,User-Agent,python-requests, Scrapy, Go-http-client, Postman, curl, wget, block the request.
Enter a Rule Name, for example, Block automated script requests.
In the If requests match... area, set the match field to Header and
user-agent. Set the match operator toContains the following items. For the match value, enterpython-requests, Scrapy, Go-http-client, Postman, curl, wget. Select Case-insensitive.In the Then execute... area, set the Action to Block and select Default Error Page for the Error Page.
Click OK. The protection rule to block automated script requests is created and takes effect.