Per-IP ceilings
Requests per address over a window, enforced at the edge before your origin sees them.
Set the ceiling before the surge.
Per-IP, per-path and per-domain request ceilings are enforced at the edge, so one client or endpoint cannot exhaust your origin.
01 / Rate limiting
Rate limits are policy, not static config: set a different ceiling for login, API and static paths, with a burst allowance that forgives short spikes without letting a sustained flood through.
Requests per address over a window, enforced at the edge before your origin sees them.
Different limits for login, API and static paths, so one hot endpoint cannot starve the rest.
Each zone sets its own thresholds and burst allowance.
Short spikes are tolerated without letting a sustained flood through.
Over-limit traffic is challenged, throttled or dropped by rule.
Every refusal carries the client, path and rule into the request record.
Set the ceilings once; every request is counted before it reaches your server.
Contact us