For the complete documentation index, see llms.txt. This page is also available as Markdown.

Path & Extension Based Rate Limiting

Path & Extension Based Rate Limiting allows you to define request rates for specific URL paths and/or file extensions, such as /api, /login, .pdf, or .jpg.

This provides more granular traffic control for specific endpoints or file types without applying the same rate limit to all requests.

Path & Extension Based Rate Limiting is available under Page Rules for Small, Large, and Dynamic CDN Resources. It is Off by default and must be explicitly enabled for each Page Rule.

Activation Requirements

  • Rate Limiting must be enabled for the resource.

  • Path & Extension Based Rate Limiting is disabled by default and must be enabled separately in the Page Rule.

  • Rate limiting rules are configured under Page Rules.

  • Each rule can define a request rate for the targeted path or file extension.

  • IP whitelisting cannot be configured separately within a Page Rule.

How Rate Limits Are Applied

Path & Extension Based Rate Limiting uses the same continuous rate enforcement behavior as resource-level Rate Limiting but applies it only to requests matching the Page Rule.

The configured limit is evaluated continuously as a request rate rather than as a fixed request count that resets at the end of the selected time period.

For example, a limit of 100 requests per minute is distributed over time and enforced continuously. It does not allow all 100 requests to be sent at once at any point during the minute.

You can configure burst behavior when the targeted path or file type needs to tolerate temporary traffic spikes above the configured request rate.

Rate Limit Options

Use Rate Limit Options to define how temporary traffic spikes above the configured request rate are handled:

  • None — Enforces the configured request rate without additional burst capacity. Requests exceeding the permitted rate are subject to the configured action.

  • Burst — Allows additional requests above the configured rate within the defined burst capacity. Requests within the burst capacity may be delayed and processed according to the configured rate.

  • Burst + No Delay — Allows requests within the defined burst capacity to pass immediately without delay.

Burst capacity does not increase the configured request rate. It provides temporary tolerance for short traffic spikes above the normal rate.

Configuration Fields

Field
Description

Path

Target URL path, such as /api/login.

File Extension

Target file extension, such as .pdf, .jpg, or .html.

Request Limit

Request rate applied to traffic matching the rule.

Time Window

Time unit used to define the request rate, such as Per Second or Per Minute.

Rate Limit Option

Determines how temporary traffic spikes above the configured request rate are handled.

Burst Value

Defines the additional capacity available for temporary traffic spikes when a burst option is selected.

If the account's default Cache Type is dynamic or edge, you must explicitly define the same Cache Type in the Page Rule when applying Path & Extension Based Rate Limiting. Otherwise, caching for that path or extension falls back to origin, and response behavior relies on origin headers.

How to Configure

1

Access Page Rules

Navigate to Page Rules in the Medianova Control Panel.

2

Click Add Rule.

3

Define the matching criteria for the rule

Define the matching criteria for the rule:

  • Path, such as /login.

  • File Extension, such as .pdf or .jpg.

4

Enable Rate Limiting within the rule.

5

Configure

  • Request Limit — Set a value between 100 and 1000.

  • Time Window — Select Per Second or Per Minute.

  • Rate Limit Option — Select None, Burst, or Burst + No Delay.

  • Burst Value — Define the burst capacity when a burst option is selected.

If the resource's default Cache Type is dynamic or edge, explicitly add the same Cache Type to the Page Rule.

6

Save the Page Rule

With None, the configured request rate is enforced without additional burst capacity. Use Burst or Burst + No Delay when the targeted traffic needs to tolerate short spikes above the configured request rate.

Page Rules are processed in order, from top to bottom. If multiple rules match the same request, only the first matching rule is applied. Place more specific rate limiting rules before broader rules that could match the same traffic.

Example

The following example applies Rate Limiting to .pdf requests under /reports:

The 100 requests per minute rate is enforced continuously rather than as a fixed allowance of 100 requests that can be consumed at once.

With Burst + No Delay, temporary traffic above the configured rate can use the defined burst capacity and requests within that capacity can pass immediately without delay.

The Burst Value is not added to the Request Limit as a separate request quota. The number of requests accepted during a traffic spike can vary depending on request timing and the configured rate.

Use Cases

  • Protect API endpoints — Apply specific request rates to paths such as /api/auth, /api/login, or /checkout.

  • Control file downloads — Apply rate limits to file extensions such as .pdf, .zip, or .jpg.

  • Combine path and extension matching — Target specific file types under paths such as /reports or /downloads.

  • Control access to static resources — Apply request rates to resources under /media/ or /static/.

  • Reduce automated traffic — Apply rate limits to product, category, search, or filter endpoints that may receive excessive automated requests.

Limitations

  • Path & Extension Based Rate Limiting is Off by default and must be enabled for each Page Rule.

  • Resource-level Rate Limiting must be enabled before using Rate Limiting in a Page Rule.

  • IP whitelisting cannot be configured separately within a Page Rule.

  • The supported Request Limit range is 100–1000.

Last updated

Was this helpful?