> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/performance-cdn/static-content-delivery/advanced-configuration/page-rules/page-rules-settings/path-and-extension-based-rate-limiting.md).

# Path & Extension Based Rate Limiting

Path & Extension Based Rate Limiting allows you to apply request rate limits to traffic matching specific URL paths and/or file extensions, such as `/api`, `/login`, `.pdf`, or `.jpg`.

This provides granular control over specific endpoints or file types without applying the same rate limit to all traffic.

Path & Extension Based Rate Limiting is available under **Page Rules** for **Small, Large, and Dynamic CDN Resources**. It is **Off by default** and must be explicitly enabled for each Page Rule.

{% hint style="info" %}
Resource-level **Rate Limiting must be enabled** before a Rate Limiting configuration in a Page Rule can take effect.
{% endhint %}

## How Rate Limiting Works in Page Rules

Path & Extension Based Rate Limiting uses the same continuous rate enforcement behavior as resource-level Rate Limiting but applies it only to traffic matching the Page Rule.

The configured limit is evaluated continuously as a request rate rather than as a fixed request count that resets at the end of the selected time period.

For example, a configuration of **100 requests per minute** is distributed over time and enforced continuously. It does not allow all 100 requests to be sent at once at any point during the minute.

When the permitted request rate is exceeded, the configured **Burst Mode** determines how temporary traffic spikes are handled.

### IP Whitelist

Each Page Rule can define its own **IP Whitelist** for Rate Limiting.

Requests from whitelisted IP addresses are excluded from the Rate Limit configured for that Page Rule. Other requests matching the Page Rule remain subject to the configured rate limit.

IP whitelists are configured independently for each Page Rule. This allows different paths or endpoints to exclude different trusted IP addresses from Rate Limiting.

### Burst Modes

You can select one of the following Burst Modes:

* **None** — Enforces the configured request rate without additional burst capacity.
* **Burst** — Allows requests above the configured rate within the defined burst capacity. Requests within this capacity may be delayed and processed according to the configured rate.
* **Burst + No Delay** — Allows requests within the defined burst capacity to pass immediately without delay.

{% hint style="info" %}
Burst capacity does not increase the configured request rate. It provides temporary tolerance for short traffic spikes above the normal rate.
{% endhint %}

When requests exceed the permitted rate and available burst capacity, they are blocked with an **HTTP 429 Too Many Requests** response.

## Configuration Fields

<table><thead><tr><th width="176.6666259765625">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>Path</strong></td><td>Defines the URL path matched by the Page Rule, such as <code>/api/login</code>.</td></tr><tr><td><strong>File Extensions</strong></td><td>Defines the file extensions matched by the Page Rule, such as <code>.html</code>, <code>.jpg</code>, or <code>.pdf</code>.</td></tr><tr><td><strong>Rate Limiting</strong></td><td>Enables or disables Rate Limiting for the Page Rule.</td></tr><tr><td><strong>Request Limit</strong></td><td>Defines the request rate applied to traffic matching the Page Rule.</td></tr><tr><td><strong>Per</strong></td><td>Defines the time unit for the request rate: <strong>Per Second</strong> or <strong>Per Minute</strong>.</td></tr><tr><td><strong>Burst Mode</strong></td><td>Determines how temporary traffic spikes above the configured request rate are handled: <strong>None</strong>, <strong>Burst</strong>, or <strong>Burst + No Delay</strong>.</td></tr><tr><td><strong>Burst Value</strong></td><td>Defines the burst capacity when <strong>Burst</strong> or <strong>Burst + No Delay</strong> is selected.</td></tr><tr><td><strong>IP Whitelist</strong></td><td>Enables or disables the IP whitelist for the Page Rule's Rate Limiting configuration.</td></tr></tbody></table>

{% hint style="info" %}
If the resource's default Cache Type is **dynamic** or **edge**, you must explicitly define the same **Cache Type** in the Page Rule when applying Path & Extension Based Rate Limiting. Otherwise, caching for that path or extension falls back to **origin**, and response behavior relies on origin headers.
{% endhint %}

## Configure Path & Extension Based Rate Limiting

{% stepper %}
{% step %}

### Access Page Rules

Navigate to the **Page Rules** tab in your CDN Resource in the [Medianova Control Panel](https://cloud.medianova.com).
{% endstep %}

{% step %}

### **Click Add Rule**

Select **Add Rule** to create a new Page Rule.
{% endstep %}

{% step %}

### Define the Traffic

Define the traffic that the Page Rule should match:

* Enter a **Path**, such as `/login`.
* Enter one or more **File Extensions**, such as `.jpg` or `.pdf`, when required.
  {% endstep %}

{% step %}

### **Select Rate Limiting**

Select **Rate Limiting** from the Page Rule settings.
{% endstep %}

{% step %}

### Enable Rate Limiting

Enable the **Rate Limiting** toggle.
{% endstep %}

{% step %}

### Configure the Rate

Configure the request rate:

* **Request Limit** — Select the request limit.
* **Per** — Select **Per Second** or **Per Minute**.
* **Burst Mode** — Select **None**, **Burst**, or **Burst + No Delay**.
* **Burst Value** — Define the burst capacity when **Burst** or **Burst + No Delay** is selected.

{% hint style="info" %}
If the resource's default **Cache Type** is `dynamic` or `edge`, explicitly add the same **Cache Type** to the Page Rule.
{% endhint %}
{% endstep %}

{% step %}

### Configure the IP Whitelist

To exclude trusted IP addresses from Rate Limiting for this Page Rule:

1. Enable **IP Whitelist**.
2. Enter an IP address in the **Add IP...** field.
3. Select **+** to add the IP address.
4. Repeat the process to add additional IP addresses when required.

Added addresses appear under **Whitelisted IPs**.

Whitelisted IP addresses bypass the Rate Limit configured for this Page Rule. Other matching requests remain subject to the configured rate limit.
{% endstep %}

{% step %}

### Save the Rule

Select **Save Rule** to apply the Page Rule configuration.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
With **None**, the configured request rate is enforced without additional burst capacity. Select **Burst** or **Burst + No Delay** when the targeted traffic needs to tolerate short spikes above the configured request rate.
{% endhint %}

{% hint style="info" %}
Page Rules are processed **in order**, from top to bottom. If multiple rules match the same request, **only the first matching rule is applied**. Place more specific rules before broader rules that could match the same traffic.
{% endhint %}

## Example

The following example applies Rate Limiting to `/api/v2` while excluding a trusted service IP from the Page Rule's rate limit:

```
Path: /api/v2
Request Limit: 100
Per: Per Minute
Burst Mode: Burst + No Delay
Burst Value: 20
IP Whitelist: On
Whitelisted IPs:  
  - 203.0.113.5
```

In this example, the configured rate of **100 requests per minute** is enforced continuously for requests matching `/api/v2`.

With **Burst + No Delay**, temporary traffic above the configured rate can use the defined burst capacity, and requests within that capacity can pass immediately without delay.

Requests from `203.0.113.5` bypass the Rate Limit configured for this Page Rule.

{% hint style="info" %}
The Burst Value is not added to the Request Limit as a separate request quota. Burst capacity provides temporary tolerance above the configured rate, and the number of requests accepted during a traffic spike can vary depending on request timing.
{% endhint %}

## Use Cases

* **Protect API endpoints** — Apply specific request rates to paths such as `/api/auth`, `/api/login`, or `/checkout`.
* **Exclude trusted service traffic** — Whitelist trusted service IP addresses that must access a rate-limited endpoint without being subject to the Page Rule's request rate.
* **Control file downloads** — Apply rate limits to file extensions such as `.jpg`, `.pdf`, or `.zip`.
* **Combine path and extension matching** — Apply Rate Limiting to specific file types under paths such as `/reports` or `/downloads`.
* **Control access to static resources** — Apply request rates to resources under `/media/` or `/static/`.
* **Reduce automated traffic** — Apply rate limits to product, category, search, or filter endpoints that may receive excessive automated requests.

## Limitations

* Path & Extension Based Rate Limiting is **Off by default** and must be enabled separately for each Page Rule.
* Resource-level **Rate Limiting must be enabled** before Rate Limiting in a Page Rule can take effect.
* The supported **Request Limit** range is **100–1000**.
* Requests exceeding the permitted rate and available burst capacity are blocked with an **HTTP 429 Too Many Requests** response.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://clients.medianova.com/products/performance-cdn/static-content-delivery/advanced-configuration/page-rules/page-rules-settings/path-and-extension-based-rate-limiting.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.