Rate limit a web app

Rate limiting caps how many requests a single source may send in a time window, keeping floods and CC attacks away from the origin.

1 Create a rule

In “Security → Rate limiting”:

1. Pick the site the rule applies to;
2. Choose the dimension (per IP or per domain);
3. Enter the threshold, e.g. “60 requests per minute”;
4. Choose the action once exceeded (return 429 / temporary ban);
5. Save.

2 Suggested thresholds

3 How it counts

Limits are counted per client IP. If a CDN sits in front of your site, make sure Fast-Https can read the real visitor IP (not the CDN origin IP), otherwise the limit hits all traffic coming through the CDN.