Path & Extension Based Rate Limiting
Path & Extension Based Rate Limiting allows you to define request rates for specific URL paths and/or file extensions, such as /api, /login, .pdf, or .jpg.
This provides more granular traffic control for specific endpoints or file types without applying the same rate limit to all requests.
Path & Extension Based Rate Limiting is available under Page Rules for Small, Large, and Dynamic CDN Resources. It is Off by default and must be explicitly enabled for each Page Rule.
Activation Requirements
Rate Limiting must be enabled for the resource.
Path & Extension Based Rate Limiting is disabled by default and must be enabled separately in the Page Rule.
Rate limiting rules are configured under Page Rules.
Each rule can define a request rate for the targeted path or file extension.
IP whitelisting cannot be configured separately within a Page Rule.
How Rate Limits Are Applied
Path & Extension Based Rate Limiting uses the same continuous rate enforcement behavior as resource-level Rate Limiting but applies it only to requests matching the Page Rule.
The configured limit is evaluated continuously as a request rate rather than as a fixed request count that resets at the end of the selected time period.
For example, a limit of 100 requests per minute is distributed over time and enforced continuously. It does not allow all 100 requests to be sent at once at any point during the minute.
You can configure burst behavior when the targeted path or file type needs to tolerate temporary traffic spikes above the configured request rate.
Rate Limit Options
Use Rate Limit Options to define how temporary traffic spikes above the configured request rate are handled:
None — Enforces the configured request rate without additional burst capacity. Requests exceeding the permitted rate are subject to the configured action.
Burst — Allows additional requests above the configured rate within the defined burst capacity. Requests within the burst capacity may be delayed and processed according to the configured rate.
Burst + No Delay — Allows requests within the defined burst capacity to pass immediately without delay.
Burst capacity does not increase the configured request rate. It provides temporary tolerance for short traffic spikes above the normal rate.
Configuration Fields
Path
Target URL path, such as /api/login.
File Extension
Target file extension, such as .pdf, .jpg, or .html.
Request Limit
Request rate applied to traffic matching the rule.
Time Window
Time unit used to define the request rate, such as Per Second or Per Minute.
Rate Limit Option
Determines how temporary traffic spikes above the configured request rate are handled.
Burst Value
Defines the additional capacity available for temporary traffic spikes when a burst option is selected.
If the account's default Cache Type is dynamic or edge, you must explicitly define the same Cache Type in the Page Rule when applying Path & Extension Based Rate Limiting. Otherwise, caching for that path or extension falls back to origin, and response behavior relies on origin headers.
How to Configure
Access Page Rules
Navigate to Page Rules in the Medianova Control Panel.
Configure
Request Limit — Set a value between 100 and 1000.
Time Window — Select Per Second or Per Minute.
Rate Limit Option — Select None, Burst, or Burst + No Delay.
Burst Value — Define the burst capacity when a burst option is selected.
If the resource's default Cache Type is dynamic or edge, explicitly add the same Cache Type to the Page Rule.
With None, the configured request rate is enforced without additional burst capacity. Use Burst or Burst + No Delay when the targeted traffic needs to tolerate short spikes above the configured request rate.
Page Rules are processed in order, from top to bottom. If multiple rules match the same request, only the first matching rule is applied. Place more specific rate limiting rules before broader rules that could match the same traffic.
Example
The following example applies Rate Limiting to .pdf requests under /reports:
The 100 requests per minute rate is enforced continuously rather than as a fixed allowance of 100 requests that can be consumed at once.
With Burst + No Delay, temporary traffic above the configured rate can use the defined burst capacity and requests within that capacity can pass immediately without delay.
The Burst Value is not added to the Request Limit as a separate request quota. The number of requests accepted during a traffic spike can vary depending on request timing and the configured rate.
Use Cases
Protect API endpoints — Apply specific request rates to paths such as
/api/auth,/api/login, or/checkout.Control file downloads — Apply rate limits to file extensions such as
.pdf,.zip, or.jpg.Combine path and extension matching — Target specific file types under paths such as
/reportsor/downloads.Control access to static resources — Apply request rates to resources under
/media/or/static/.Reduce automated traffic — Apply rate limits to product, category, search, or filter endpoints that may receive excessive automated requests.
Limitations
Path & Extension Based Rate Limiting is Off by default and must be enabled for each Page Rule.
Resource-level Rate Limiting must be enabled before using Rate Limiting in a Page Rule.
IP whitelisting cannot be configured separately within a Page Rule.
The supported Request Limit range is 100–1000.
Last updated
Was this helpful?