Back to Checks
cloudflare

Rate limiting is configured for the zone

zone_rate_limiting_enabled
Service: zoneSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Zone

Cloudflare zones are assessed for Rate Limiting configuration by checking if rules are configured to protect against DDoS attacks, brute force attempts, and API abuse.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without Rate Limiting, applications are vulnerable to volumetric attacks.

  • Confidentiality: credential brute forcing can compromise user accounts
  • Integrity: API abuse can manipulate data through excessive requests
  • Availability: volumetric attacks can exhaust resources causing service degradation

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_rate_limiting_enabled

Recommendation

Implement Rate Limiting as part of defense in depth.

  • Configure thresholds based on expected traffic patterns
  • Apply stricter limits to sensitive endpoints like authentication and APIs
  • Use different rate limits for different paths or endpoints
  • Monitor rate limiting analytics to fine-tune thresholds

Remediation

Terraform

# Configure Rate Limiting to protect against volumetric attacks
resource "cloudflare_ruleset" "rate_limit" {
  zone_id = "<ZONE_ID>"
  name    = "Rate limiting"
  kind    = "zone"
  phase   = "http_ratelimit"
  rules {
    action = "block"
    ratelimit {
      characteristics     = ["ip.src"]
      period              = 60
      requests_per_period = 100
      mitigation_timeout  = 600
    }
    expression  = "true"
    description = "Rate limit all requests"
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to Security > WAF > Rate limiting rules
3Create a new rate limiting rule
4Configure thresholds based on expected traffic patterns
5Apply stricter limits to sensitive endpoints like authentication and APIs

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_rate_limiting_enabled(Check):
    """Ensure that Rate Limiting is configured for Cloudflare zones.

    Rate Limiting protects against DDoS attacks, brute force attempts, and API
    abuse by limiting the number of requests from a single source within a specified
    time window. Rules are configured in the http_ratelimit phase and help maintain
    service availability under high-traffic conditions.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the Rate Limiting enabled check.

        Iterates through all Cloudflare zones and verifies that at least one
        enabled rate limiting rule exists.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if rate
            limiting rules are configured, or FAIL status if no rules exist.
        """
        findings = []

        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )

            # Get enabled rate limiting rules for this zone
            enabled_rules = [rule for rule in zone.rate_limit_rules if rule.enabled]

            if enabled_rules:
                report.status = "PASS"
                rules_str = ", ".join(
                    rule.description or rule.id for rule in enabled_rules
                )
                report.status_extended = (
                    f"Rate limiting is configured for zone {zone.name}: {rules_str}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"No rate limiting rules configured for zone {zone.name}."
                )
            findings.append(report)

        return findings

References