Check ID: zone_rate_limiting_enabled
Provider: Cloudflare
Service: zone
Severity: HIGH
Categories: internet-exposed
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for Rate Limiting configuration by checking if rules are configured to protect against DDoS attacks, brute force attempts, and API abuse.

​
Risk

Without Rate Limiting, applications are vulnerable to volumetric attacks.
  • Confidentiality: credential brute forcing can compromise user accounts
  • Integrity: API abuse can manipulate data through excessive requests
  • Availability: volumetric attacks can exhaust resources causing service degradation

​
Recommendation

Implement Rate Limiting as part of defense in depth.
  • Configure thresholds based on expected traffic patterns
  • Apply stricter limits to sensitive endpoints like authentication and APIs
  • Use different rate limits for different paths or endpoints
  • Monitor rate limiting analytics to fine-tune thresholds

​
Remediation

# Configure Rate Limiting to protect against volumetric attacks
resource "cloudflare_ruleset" "rate_limit" {
  zone_id = "<ZONE_ID>"
  name    = "Rate limiting"
  kind    = "zone"
  phase   = "http_ratelimit"
  rules {
    action = "block"
    ratelimit {
      characteristics     = ["ip.src"]
      period              = 60
      requests_per_period = 100
      mitigation_timeout  = 600
    }
    expression  = "true"
    description = "Rate limit all requests"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_rate_limiting_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks