Rate limits that don’t hit real people

Keys, thresholds, and challenge versus block

A rate limiting rule keyed only on IP address punishes everyone behind a shared address — a university, a mobile carrier, a VPN exit. Your visitors see 1015; your logs see one IP.

Pick the right key

Key on IP plus something that separates people: a session cookie, an API token, or the path. Cloudflare’s rate limiting rules support these characteristics; use them.

Set thresholds from data

Measure how fast a real user hits the endpoint (login: a few per minute; search: maybe 30). Set the limit above that and let bots find it. A threshold guessed low is the usual reason for complaints.

Prefer challenge over block

A Managed Challenge lets a real browser through with a moment’s friction and stops bots; a Block turns every false positive into a lost visitor with a 1015 they cannot recover from.

Scope tightly

Rate-limit the expensive endpoints, not the whole site. Static pages and assets never need it.

All guides