Rate Limiting Rules

A rate limit may be applied:

• Indiscriminately across all requests.

• To each unique client that exceeds the defined rate limit.

  A unique client may be identified by its user agent and/or IP address.

Identify the type of requests that are eligible for rate limiting by:

• Hostname
• URL path

Define a maximum request rate before a predefined action is triggered.

Identify the type of requests that are eligible for rate limiting by URL path, request headers, IP address, file extension, and/or request method.

A request will only count towards the rate limit when it satisfies the rule's scope. Additionally, if one or more condition group(s) have been defined, then the request must also satisfy all of the conditions defined within at least one condition group.

Indicates that all requests will count towards the rate limit. Once the specified rate limit is exceeded, it will be enforced without taking into consideration which client submitted the request.

This mode is not recommended when there are malicious clients that are spoofing legitimate traffic. This type of configuration may potentially lead to a situation where spoofed traffic is honored while legitimate traffic is rate limited.

Indicates that the requests from each unique client, as determined by its IP address, will be tracked. The specified rate limit will only be enforced on the clients that exceed it.

Determines whether this rate limit will be applied to all or specific hostnames.

For the purpose of defining a rate limiting scope, the hostname associated with a request is determined by the request's Host header.

Select one of the following modes:

• Default: This mode does not restrict rate limiting by hostname.

• Exact match (multiple entries): Applies the rate limit to the specified hostname(s).

  Learn more.

• Regex match: Applies the rate limit to all hostnames that satisfy the specified regular expression pattern.

  Learn more.

• Wildcard match: Applies the rate limit to all hostnames that satisfy the specified wildcard pattern.

  Learn more.

Additional restrictions by hostname may be defined through condition groups. Those hostname restrictions are applicable regardless of the selected mode.
Learn more.

A request will count towards the rate limit when the filename of the requested content contains a file extension that matches a value defined in the Value(s) option.

Syntax:

Example:

A request will count towards the rate limit when its IP address matches a value defined in the Value(s) option.

Make sure to use standard IPv4 and CIDR notation.

Specify a subnet by appending a slash (/) and the desired bit-length of the prefix (e.g., 11.22.33.0/22).

A request will count towards the rate limit when the value corresponding the specified request header is an exact case-sensitive match for the one defined in the Value(s) option.

This condition supports the following request headers:

• Host
• User-Agent
• Referer

Host

A request will count towards the rate limit when its Host header matches the specified hostname or IP address.

Syntax:

• Host
• Host:Port

Key information:

• The entire Host header value will be compared against the specified value.
• The CDN only accepts HTTP/HTTPS requests on standard ports (i.e., 80 and 443). Typically, a Host request header does not include port information for standard ports. However, the requesting user agent defines the Host request header submitted to the CDN.
• For the purpose of this comparison, the hostname defined by this match condition will not be resolved to an IP address.
• For the purpose of this comparison, a customer origin's HTTP Host Header option is irrelevant.

User-Agent

A request will count towards the rate limit when its User-Agent header matches the specified user agent.

The request's user agent must be an exact match to the specified value. User agent strings typically vary by type and version.

Match for requests with a blank or missing User-Agent header by specifying a blank value.

Referer

A request will count towards the rate limit when its Referer header matches the specified referrer.

The request's referrer must be an exact match to the specified value.

A request will count towards the rate limit when the request's HTTP method matches a value defined in the Value(s) option.

Valid values are:

• GET
• POST
• PUT
• HEAD
• DELETE
• OPTIONS

Rate limited requests will be redirected to the specified URL.

Key information:

• The HTTP status code for this response will be a 302 Found.

• Set the URL option to the URL to which rate limited requests will be redirected. Make sure to specify a full URL.

  Example:

  http://cdn.mydomain.com/marketing/busy.html

Rate limited requests will receive the response defined under this option.

Configure the following settings:

• Response body: Defines the payload that will be delivered to the client in response to a rate limited request.

  For example, the payload of a CSS file might look something like:

  body {

  background-color: #ffffff;

  }

• HTTP status code: Defines the HTTP status code that will be sent to the client. Either select or type the desired status code.

• Custom response headers: Defines one or more response headers that will be sent to the client. Define each custom response header on a separate line.

  Format:

  Name:Value

  Example:

  MyCustomHeader:True

Rate limited requests will be dropped and the client will receive the following response:

• HTTP status code: 503 Service Unavailable
• Response header: Retry-After: 10 seconds

The Retry-After response header provides a hint to the client as to when service may resume.