Rate Limiting Goes Unmetered For All Plans
Cloudflare is extending its unmetered security model to Rate Limiting. Five years after making DDoS protection available to every customer without usage charges, the company is doing the same for its Rate Limiting product, which until now was a paid add-on for Free, Pro and Business plans at $5 per million requests.
The change means those plans now include Rate Limiting rules at no extra cost, regardless of how much traffic the rules evaluate. Cloudflare frames the move as a continuation of its broader security posture: since unmetered DDoS mitigation launched in 2017, the company has absorbed attacks as large as 2 Tbps and, more recently, a 26 million requests-per-second campaign. Making Rate Limiting universally available, the argument goes, raises the baseline security of the millions of applications already on the platform.
What's Included In Each Plan
New customers get the new Rate Limiting by default, with rules included per plan:
| FREE | PRO | BUSINESS | |
|---|---|---|---|
| Number of rules | 1 | 2 | 5 |
Existing customers are grandfathered in with a matching number of unmetered rules. If a Business customer had nine active rules in the previous version as of September 20, 2022, they get nine rules in the new system. There is no charge for these rules, no matter the traffic they process.
Customers who want to migrate should note that the previous Rate Limiting version remains billable while in use. Cloudflare recommends rewriting existing rules in the new engine, which offers all prior capabilities plus additional features. The old version is slated for eventual deprecation, though the company says it will give ample notice before retiring it.
A New Engine Behind The Rules
The updated Rate Limiting product shares its foundation with Advanced Rate Limiting, the enterprise-grade ruleset engine that also powers Custom Rules. This gives Free, Pro and Business customers the same rule-building experience previously reserved for Enterprise contracts.
The feature set breaks down as follows:
| FREE | PRO | BUSINESS | ENT with WAF Essential |
ENT with Advanced Rate Limiting |
|
|---|---|---|---|---|---|
| Fields available (request) | Path | Host URI Path Full URI Query |
Host URI Path Full URI Query Method Source IP User Agent |
All fields available in Custom Rules: Including request metadata(1). | Same WAF Essential. Request Bot score(1) and body fields(2) |
| Counting expression | Not available | Not available | Available with access to response headers and response status code | Available with access to response headers and response status code | Available with access to response headers and response status code |
| Counting characteristics | IP | IP | IP | IP IP with NAT awareness |
IP IP with NAT awareness Query Host Headers Cookie ASN Country Path JA3(2) JSON field (New!) |
| Max Counting period | 10 seconds | 60 seconds | 10 minutes | 10 minutes | 1 hour |
| Price | Free | Included in monthly subscription | Included in monthly subscription | Included in contracted plan | Included in contracted plan |
(1): Requires Bots Management add-on
(2): Requires specific plan
The most significant architectural change is that the counting expression and the mitigation expression are now separate. Previously, a Rate Limiting rule could only scope traffic by a single path and method. Now customers can, for example, count requests to /login and block traffic from an offending IP across the entire domain once the threshold is exceeded.
This separation also enables rules that key off response parameters, such as Origin Status Code or HTTP Response Headers. In that case, Cloudflare recommends building a counting expression that includes the response fields and an explicit mitigation filter describing which requests trigger a block.
Building Richer Rules
With the ruleset engine, rules can combine multiple HTTP request parameters the same way Custom Rules do. Pro domains can use OR and AND operators to match several paths in one rule. Business domains can also filter on Source IP or User Agent, allowing different rate limits for different clients, or use IP Lists to include or exclude specific addresses from a rule.
Rate limiting dimensions remain IP-based for Free, Pro and Business customers, meaning requests are grouped by source IP address. Advanced Rate Limiting, still an Enterprise offering, extends grouping to API keys, cookies, session headers, ASN, query parameters, JSON body fields (such as a username in a login request) and more.
Timing And Availability
The new Rate Limiting rules appear in the dashboard under the WAF tab, where both old and new versions are visible side by side. Pro and Business customers saw the product enabled on September 29, 2022; Free customers get their rules during the week starting October 3, 2022.
Enterprise customers do not automatically receive Rate Limiting under their contracts. When WAF with Rate Limiting is included, it provides access to 100 rules and a broader field set in the rule builder, with the option to upgrade to Advanced Rate Limiting. Enterprise teams using the previous version should contact their account team to discuss migration options.
The WAF team plans to add analytics to support rule creation. Because the new Rate Limiting runs on the same engine as the rest of the WAF, it can also adopt new fields as they ship; Enterprise customers, for instance, can combine Bot Score or WAF Attack Score with rate limiting rules.
