Configure Cloudflare Rate Limiting to Protect an API Endpoint

Desired outcome

Create a Cloudflare Rate Limiting rule that blocks or challenges abusive requests to an origin API while allowing legitimate traffic to reach the backend.

Prerequisites

• The domain must be active on Cloudflare with DNS set to Proxied (orange cloud) so that HTTP(S) traffic traverses Cloudflare’s edge network.
• You need permission to edit Firewall rules in the Cloudflare dashboard (typically an Admin or Super Administrator role).
• Identify the API path you want to protect (e.g., /api/v1/) and the HTTP method(s) to match (e.g., GET, POST).
• If another proxy or CDN sits in front of Cloudflare, ensure the true client IP is forwarded via the CF-Connecting-IP header; otherwise rate limiting may act on the wrong address.

Procedure

1. Open the Rate Limiting tool

   In the Cloudflare dashboard, select your zone, then navigate to Security → Firewall → Tools → Rate Limiting and click Create a Rate Limiting Rule.

2. Define match criteria

   Set the rule to trigger on requests that match your API. Example:

   Request URI  contains  /api/v1/
   AND Request Method  is  POST

   You can add additional conditions (e.g., specific query parameters) using the AND operator.

3. Set threshold and action

   Choose a request limit appropriate for your traffic pattern. For illustration, use:

   • Threshold: 120 requests per minute
   • Action: Block (alternatives: JS Challenge or Managed Challenge)
   • Penalty period: 300 seconds (5 minutes) during which matching requests exceeding the threshold are subjected to the chosen action.

   Enter these values in the corresponding fields.

4. Save and deploy

   Click Save. The rule propagates globally; Cloudflare notes that this may take up to two minutes.

Expected checks

1. Validate legitimate traffic

   From a client not exceeding the limit, send a few requests (e.g., 10) using curl or Postman:

   curl -i -X POST https://example.com/api/v1/resource
   

   Each request should return a 200 OK (or the expected success status) from your origin, indicating the request was not challenged or blocked.

2. Trigger the limit

   Send a burst that exceeds the threshold (e.g., 150 POST requests within a minute). A simple loop:

   for i in {1..150}; do curl -s -o /dev/null -w "%{http_code}\n" -X POST https://example.com/api/v1/resource; done
   

   After the first 120 requests, subsequent responses should show the configured action: 429 Too Many Requests for a Block, or a JavaScript challenge page (HTTP 200 with a challenge body) for JS Challenge.

3. Inspect Cloudflare logs

   In the dashboard, go to Firewall → Events. Filter by the rule ID (visible in the rule’s details) and verify that the count of events matching the action equals the number of excess requests you sent.

4. Confirm origin isolation

   Check your origin server’s access logs (e.g., Nginx access.log) for the same time window. Only requests under the threshold should appear; requests that were blocked or challenged at the edge should not reach the origin.

Recovery options (rollback)

Creating or modifying a Rate Limiting rule changes the zone’s configuration, so a rollback is advisable if the rule causes unintended blockage.

• Disable the rule: In the Rate Limiting list, toggle the switch off for the rule. This stops enforcement immediately while preserving the rule for later tuning.
• Delete the rule: Click the trash‑can icon next to the rule and confirm deletion. This removes the rule entirely; you can recreate it later with adjusted parameters.
• Adjust threshold: Edit the rule and increase the request limit (e.g., from 120 to 300 per minute) to reduce false positives, then save.

After any change, repeat the validation steps above to confirm that legitimate traffic flows normally and that abusive bursts are still mitigated.