Stop brute force and floods with Cloudflare rate limiting rules

Rate limiting counts how many requests each visitor sends in a short period and acts when they go over a limit. It is the right tool for attacks that look like normal traffic, only far too much of it: password guessing, scraping, repeated searches or small HTTP floods.

Before you start

• Your domain must be proxied through Cloudflare. Set up basic protection first with Cloudflare WAF custom rules.
• The free plan includes one rate limiting rule with fixed periods; paid plans allow more rules and options such as counting by header.

Create a rate limiting rule

1. In the Cloudflare dashboard choose your domain and go to Security → WAF → Rate limiting rules.
2. Click Create rule and give it a clear name, such as Login brute force.
3. Under If incoming requests match, use Edit expression:
   Copy

   (http.request.uri.path eq "/wp-login.php" and http.request.method eq "POST")

4. Under With the same characteristics, keep IP.
5. Set When rate exceeds to, for example, 5 requests per 1 minute.
6. Choose the action: Block or Managed Challenge, and a duration such as 10 minutes.
7. Click Deploy.

Suggested thresholds

Start generous. A single page load can make dozens of requests for images, CSS and scripts, though most are served from Cloudflare's cache and still count only if the rule matches them. Exclude static files in whole-site rules:

(not http.request.uri.path.extension in {"css" "js" "png" "jpg" "webp" "svg" "woff2"})

Test and monitor

• Try logging in with a wrong password six times in a minute from mobile data; the sixth attempt should be blocked or challenged.
• Check Security → Events, filter by the rule name and confirm only abusive IPs are caught.
• Your hosting firewall still protects SSH, mail and cPanel, which Cloudflare does not proxy.

Next steps

• DDoS protection basics
• WordPress security hardening
• LiteSpeed anti-DDoS reCAPTCHA