The Stampede
Loan forms, login, and checkout draw a stampede of bots, card-testers, and credential-stuffers. Cloudflare's Rate Limiting throttles the flood at the edge, before it ever reaches your origin.
The pain
Login, checkout, and API endpoints draw bots, card-testers, and credential-stuffers that pound origin and run up the bill.
The fix
A Rate Limiting binding throttles abusive callers at the edge, returning 429 before the flood ever reaches origin.
So what
Keep origin healthy under attack, cut wasted compute spend, and blunt credential-stuffing without touching app code.
Try it
Stampede the gate.
The edge allows the first 5 requests per 10 seconds, then throttles the rest with a 429. Hammer it and watch the herd get turned back.
Edge rate limiting at 5 requests / 10s per key: the native Workers Rate Limiting binding, with a D1 sliding-window fallback on Pages (where that binding isn't supported yet). The window refills over time, so wait a few seconds and the gate opens again.
How it works
A Rate Limiting binding throttles abusive callers at the edge, before they ever reach origin.
Add it to your site
1 binding · a few lines"ratelimits": [
{ "name": "STAMPEDE_LIMITER", "namespace_id": "1001",
"simple": { "limit": 5, "period": 10 } }
]const ip = request.headers.get('CF-Connecting-IP') ?? 'anon';
const { success } = await env.STAMPEDE_LIMITER.limit({ key: ip });
if (!success) return new Response('Slow down', { status: 429 });Official Cloudflare docs