Rate limiting in Edge Security Acceleration (ESA) lets you control requests that match specific features. For example, if a client IP accesses your site at a high frequency, you can use this feature to apply a slider challenge or block the IP for a specified period after a threshold is exceeded.
Function introduction
Rate limiting uses dynamic risk control to detect and block Distributed Denial of Service (DDoS) and CC attacks. This feature lets you set queries per second (QPS) thresholds and apply actions such as observation, slider challenges, and blocking for periods ranging from 10 seconds to 24 hours. You can also create multi-dimensional rules based on parameters such as client IP and User-Agent that take effect in real time. When combined with Web Application Firewall (WAF) and Anti-DDoS, rate limiting provides a comprehensive risk control solution.
The following video demonstrates how to configure a rule to block high-frequency requests that exceed the rate limit.
Configure a rate limiting rule
This section uses an example to explain the configuration fields and guide you through setting up a rate limiting rule.
Example scenario: Many requests are sent to the hostnames www.example.com and image.example.com. If a client IP sends more than 20 requests within 10 seconds, a slider challenge is applied to subsequent requests from that IP address for 5 minutes. Only requests that pass the challenge are processed normally. All other requests are blocked.
Procedure
In the ESA console, go to Site Management. In the Actions column of the target site, click
> WAF.In the navigation pane on the left, choose .
On the WAF page, select the Rate Limiting Rules tab, click Create Rule, and enter the required information for the rule.
Enter a Rule Name.
If requests match...: Specifies the conditions that requests must meet. For more information about match fields, see Components of a rule expression. In this example, set Match Type to Hostname, set Operator to is one of, and enter
www.example.comandimage.example.comfor Value.Apply to Cache: Rate limiting controls the number of client requests based on a specific feature to reduce the load on your origin server. However, requests that hit the cache are served directly by ESA and do not add load to your origin server. If you do not want to apply rate limiting to these cached requests, clear this checkbox.
With the same characteristics...: Further filters requests that meet the match conditions.
When the rate exceeds...: Specifies the maximum number of requests allowed within the specified time period.
NoteIf you set the action to Apply to Matched Requests, the action duration equals the statistical period.
WAF counts a request only after the full response is sent. Therefore, for requests to download large files, the blocking action may be delayed because of the long download time.
Then execute...: The action to perform when the request rate reaches the limit. You can apply the action to only requests that exceed the limit, or to all subsequent matching requests. For more information, see Action descriptions.
Click OK.
Result
The rule is applied to all requests, including cached and back-to-origin requests, that are sent to the hostname www.example.com or image.example.com. If the number of requests from a single source IP address exceeds 20 per 10 seconds, a slider challenge is applied to all subsequent requests from that IP address for 1 minute.
Availability by plan
Feature | Basic | Standard | Advanced | Enterprise |
Number of rate limiting rules | 1 | 3 | 5 | 10 |