Rate Limits

Rate limit rules protect applications from repeated requests, automated abuse, and endpoint-specific bursts.

Syntax

RULE=<rule_name>
PRIORITY=<number>
ACTION=<ALLOW|BLOCK>
CHAIN=<STOP|CONTINUE>
LIMIT=<number>
WINDOW_SEC=<seconds>
KEY=<IP|HEADER:<Header-Name>>
IF PATH=<path>
IF PATH_PREFIX=<prefix>

Not every key is required for every rule. Bypass rules often use ACTION=ALLOW and CHAIN=STOP; enforcement rules use LIMIT, WINDOW_SEC, and KEY.

Examples

RULE=assets_bypass
PRIORITY=1
ACTION=ALLOW
CHAIN=STOP
IF PATH_PREFIX=/assets/

RULE=rl_login
ACTION=BLOCK
LIMIT=10
WINDOW_SEC=60
KEY=IP
IF PATH=/api/login

Allowed actions

Action	Meaning
ALLOW	Allow request and optionally stop further rate-limit processing.
BLOCK	Block when limit is exceeded.

Keys

Key	Meaning
IP	Use resolved client IP.
HEADER:<name>	Use a header value as the rate key, only when trusted and appropriate.

Best practices

• Add bypass rules for health checks, static assets, and well-known metadata before strict rules.
• Rate-limit sensitive endpoints such as login, contact forms, checkout, and admin APIs.
• Avoid very low limits on normal web pages unless you have tested real user behavior.