--- description: Sample rate limiting rule configurations for login pages, APIs, and geographic restrictions. title: Rate limiting rule examples image: https://developers.cloudflare.com/og-docs.png --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt > Use this file to discover all available pages before exploring further. # Rate limiting rule examples Last updated Aug 24, 2026|Copy as Markdown|[View as Markdown](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/waf/rate-limiting-rules/use-cases/index.md)|[Agent setup](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/agent-setup/) The examples below include sample rate limiting rule configurations. ## Example 1 The following [rate limiting rule](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/waf/rate-limiting-rules/create-zone-dashboard/) performs rate limiting on incoming requests from the US addressed at the login page, except for one allowed IP address. **When incoming requests match:** | Field | Operator | Value | | | ----------------- | -------------- | ------------- | --- | | URI Path | equals | /login | And | | Country | equals | United States | And | | IP Source Address | does not equal | 192.0.0.1 | | If you are using the expression editor: `(http.request.uri.path eq "/login" and ip.src.country eq "US" and ip.src ne 192.0.0.1)` **With the same characteristics:** * _IP_ * _Data center ID_ (included by default in the dashboard, but not shown) ## Example 2 The following [rate limiting rule](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/waf/rate-limiting-rules/create-zone-dashboard/) performs rate limiting on incoming requests with a given base URI path, incrementing on the IP address and the provided API key. **When incoming requests match:** | Field | Operator | Value | | | -------------- | -------- | -------- | --- | | URI Path | contains | /product | And | | Request Method | equals | POST | | If you are using the expression editor: `(http.request.uri.path contains "/product" and http.request.method eq "POST")` **With the same characteristics:** * _IP_ * _Header value of_ \> `x-api-key` * _Data center ID_ (included by default in the dashboard, but not shown) ## Example 3 The following [rate limiting rule](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/waf/rate-limiting-rules/create-zone-dashboard/) performs rate limiting on requests targeting multiple URI paths in two hosts, excluding known bots. The request rate is based on IP address and `User-Agent` values. **When incoming requests match:** `(http.request.uri.path eq "/store" or http.request.uri.path eq "/prices") and (http.host eq "mystore1.com" or http.host eq "mystore2.com") and not cf.client.bot` **With the same characteristics:** * _IP_ * _Header value of_ \> `user-agent` * _Data center ID_ (included by default in the dashboard, but not shown) ## Example 4 Note [Complexity-based rate limiting](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/waf/rate-limiting-rules/request-rate/#complexity-based-rate-limiting) is only available to Enterprise customers with Advanced Rate Limiting. The following [rate limiting rule](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/waf/rate-limiting-rules/create-zone-dashboard/) performs complexity-based rate limiting. The rule takes into account the `my-score` HTTP response header provided by the origin server to calculate a total complexity score for the client with the provided API key. The counter with the total score is updated when there is a match for the rate limiting rule's [counting expression](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/waf/rate-limiting-rules/parameters/#increment-counter-when) (in this case, the same as the rule expression since a counting expression was not provided). When this total score becomes larger than `400` during a period of one minute, any later client requests will be blocked for a period of 10 minutes. **When incoming requests match:** | Field | Operator | Value | | -------- | -------- | ----------- | | URI Path | wildcard | /graphql/\* | If you are using the expression editor: `(http.request.uri.path wildcard "/graphql/*")` **With the same characteristics:** * _Header value of_ \> `x-api-key` * _Data center ID_ (included by default in the dashboard, but not shown) When rate exceeds: **Complexity based** * Score per period: `400` * Period: _1 minute_ * Response header name: `my-score` Then take action: * Choose action: _Block_ With the following behavior: **Block for the selected duration** * Duration: _10 minutes_ For an API example with this rule configuration, refer to [Create a rate limiting rule via API](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/waf/rate-limiting-rules/create-api/#example-d---complexity-based-rate-limiting-rule). Was this helpful? YesNo ## On this page [![](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://docs-durable-objects-instance-replaced-errors.previews.developers.cloudflare.com/) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/waf/rate-limiting-rules/use-cases/#page","headline":"Rate limiting rule examples ยท Cloudflare Web Application Firewall (WAF) docs","description":"Sample rate limiting rule configurations for login pages, APIs, and geographic restrictions.","url":"https://developers.cloudflare.com/waf/rate-limiting-rules/use-cases/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-08-24","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ```