Rate limit to challenge until challenge is solved?

I have a rate limit rule to challenge 10 requests within 10 sec. When I try this with curl I'm sure challenged after 10 req. However if I just let those 10 seconds pass, then I can do 10 more requests the next 10 seconds. I feel like I'd like to keep it limited until they solve the request?

SuperHelpflare•12/22/25, 11:14 AM

Support AI

I understand your concern. According to the documentation, when a rate limit rule is triggered, the action (in this case, challenge) is applied for a specified duration. However, this duration only applies to the specific IP address that triggered the rule, and it does not persist across different time periods.

As you've observed, if the time period (10 seconds in your case) passes, the counter is reset, and the IP address can make another 10 requests within the next 10 seconds.

If you want to keep the IP address limited until they solve the challenge, you may want to consider increasing the duration of the action. However, please note that this will also increase the time period during which the IP address is blocked or challenged, even after they've solved the challenge.

Alternatively, you can consider using a different approach, such as using a cookie or a token to track the IP address's progress and only allow them to make requests once they've solved the challenge. However, this would require a more complex setup and may not be feasible with the current rate limiting rules.

For more information on rate limiting rules and their behavior, you can refer to the Cloudflare documentation: https://developers.cloudflare.com/waf/reference/legacy/old-rate-limiting/

Sources

This is an AI generated response, it may not be 100% accurate. Please validate the output. You can ask followups by replying to this message or mentioning me.

Rate limit to challenge until challenge is solved?

Similar Threads

Similar Threads

Similar Threads