> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/security/rate-limiting.md).

# Rate Limiting

## Rate Limiting

**Rate Limiting** helps protect your applications and origin infrastructure by controlling the rate at which clients can send requests to your CDN resource.

Rate limits are enforced at the **CDN edge**, before requests reach your origin servers. This helps reduce excessive traffic caused by high-frequency requests, abusive clients, automated traffic, or unexpected traffic spikes.

{% hint style="info" %}
Rate Limiting is available for **Dynamic CDN Resources** through the [**Medianova Control Panel**](https://cloud.medianova.com).
{% endhint %}

## **Why Use Rate Limiting?**

Rate Limiting helps you:

* Protect **origin servers and APIs** from excessive request traffic.
* Reduce the impact of **automated or abusive request patterns**.
* Protect sensitive endpoints such as **login and authentication services**.
* Prevent excessive requests from consuming unnecessary origin compute or database resources.
* Define request rates appropriate for different application workloads.

## **How Rate Limiting Works**

Rate Limiting evaluates incoming requests against a configured **request rate**.

You define the number of requests and a time unit, such as **Per Second** or **Per Minute**. The configured limit is evaluated continuously as a request rate rather than as a fixed request count that resets at the end of the selected time period.

For example, a limit of **100 requests per minute** is distributed over time and enforced continuously. It does not allow all 100 requests to be sent at once at any point during the minute.

You can use burst options when your application needs to tolerate short traffic spikes above the configured request rate.

## **Rate Limit Options**

Rate Limit Options determine how temporary traffic spikes above the configured request rate are handled:

* **None** – Enforces the configured request rate without additional burst capacity. Requests exceeding the permitted rate are subject to the configured action.
* **Burst** – Allows additional requests above the configured rate within the defined burst capacity. Requests within the burst capacity may be delayed and processed according to the configured rate.
* **Burst + No Delay** – Allows requests within the defined burst capacity to pass immediately without delay.

{% hint style="info" %}
Burst capacity does not increase the configured request rate. It provides temporary tolerance for short traffic spikes above the normal rate.
{% endhint %}

## **Key Features**

* **Configurable Request Rates** – Define request rates per second or minute based on your application requirements.
* **Edge-Level Enforcement** – Apply rate limits at the CDN edge before excessive traffic reaches your origin.
* **Burst Control** – Control how temporary traffic spikes above the configured request rate are handled.
* **IP Whitelisting** – Exclude trusted IP addresses or networks from rate enforcement.
* **Configurable Actions** – Define how requests are handled when the permitted rate is exceeded.
* **Configurable Response Codes** – Select the HTTP response code returned for blocked requests.
* **Path & Extension Based Rate Limiting** – Apply separate rate limiting rules to specific URL paths or file extensions through Page Rules.

## **Use Cases**

* **API Protection** – Control high-frequency API requests and reduce excessive origin traffic.
* **Authentication Endpoints** – Limit request rates for login and authentication services.
* **Traffic Spike Management** – Control short increases in request traffic based on your application requirements.
* **Bot and Scraper Control** – Reduce excessive requests generated by automated clients.
* **Origin Protection** – Prevent high request rates from unnecessarily consuming origin compute, application, or database resources.

## **Resource-Level and Path-Based Rate Limiting**

Resource-level Rate Limiting for **Dynamic CDN Resources** is configured under **Security → Rate Limiting** in the [Medianova Control Panel](https://cloud.medianova.com).

{% hint style="info" %}
For more granular control, **Path & Extension Based Rate Limiting** can be configured through **Page Rules** to apply separate limits to specific URL paths or file extensions.
{% endhint %}

For example, you can apply different rate limits to:

* `/login`
* `/api/`
* `/checkout`
* `.pdf`
* `.mp4`

See [Path & Extension Based Rate Limiting](/products/performance-cdn/static-content-delivery/advanced-configuration/page-rules/page-rules-settings/path-and-extension-based-rate-limiting.md) for more information.

{% hint style="info" %}
Start with moderate request rates and adjust them based on your application's normal traffic patterns. Limits that are too restrictive may affect legitimate users or API traffic.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://clients.medianova.com/products/security/rate-limiting.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.