◈
Editorial verdict
Choose Cloudflare Rate Limiting when traffic already traverses Cloudflare and its plan-supported matching, counting, action, and observability model fits the policy.12
Best for
- Early edge enforcement
- Cloudflare-proxied websites and APIs
- Rules based on supported request characteristics
12Not ideal for
- Product quotas requiring private application state
- Traffic that bypasses Cloudflare
- Teams needing provider-neutral policy
12Main trade-offEdge enforcement protects origins early while accepting Cloudflare rule semantics, plan gates, observability, false-positive risk, and bypass considerations.12
Product boundary
Whether request quotas should be enforced at Cloudflare's edge under its rule, characteristic, period, action, and plan boundaries.
Cloudflare Rate Limiting is a product-specific rules surface evaluated separately from the broad Cloudflare platform and WAF rules. It can count only data available at its enforcement point and does not replace application authorization, business quotas, bot detection, or origin-side resilience.12
For: Teams already proxying relevant traffic through Cloudflare and wanting edge request-rate controls
- Traffic no longer traverses Cloudflare
- Private application identity is required for the key
- Plan limits, rules, actions, or observability do not fit
Why teams consider Cloudflare Rate Limiting
- Edge placementRequests can be limited before reaching the origin.12
- Rule matchingExpressions select traffic while counting characteristics define the quota key.12
- Plan progressionPublished plan tables describe increasing fields, periods, characteristics, actions, and rule counts.12
Availability and capability vary across Cloudflare Free, Pro, Business, and Enterprise application-security plans; rules, fields, characteristics, periods, actions, logging, and adjacent products are plan-specific.2
Current decision boundary
Cloudflare application-security plan boundary
Verified 2026-07-27: rate-limiting rules exist across Cloudflare plans with materially different rule counts, fields, counting characteristics, periods, and advanced capabilities.2
- Primary boundary
- Zone or enterprise plan and enabled application-security products2
- Capability variables
- Rules, fields, characteristics, periods, actions, and logging2
- Policy duty
- Bypass analysis, false positives, application identity, retry behavior, and origin controls2
Cloudflare Rate Limiting vs alternatives
Upstash Ratelimit
- Choose when
- TypeScript serverless and edge handlers
- Avoid when
- Fleet-wide gateway policy
- Compared with Cloudflare Rate Limiting
- Application-level control improves product context while adding library, state-service, latency, consistency, failover, and usage-cost dependencies.34
Kong Gateway
- Choose when
- Shared API gateway policy
- Avoid when
- One small application limiter
- Compared with Cloudflare Rate Limiting
- Central policy reduces service duplication while adding gateway availability, configuration, edition, storage, plugin, data-plane, and migration responsibilities.56
Envoy
- Choose when
- Existing Envoy data planes
- Avoid when
- Turnkey managed rate limiting
- Compared with Cloudflare Rate Limiting
- Proxy-level flexibility increases control while transferring correctness, state, rollout, resilience, observability, capacity, and upgrades to the platform team.78
Official product, pricing, policy, and operating sources
- Cloudflare rate-limiting rules
- Cloudflare application services plans
- Upstash Ratelimit overview
- Upstash Redis pricing
- Kong Gateway rate limiting
- Kong pricing
- Envoy rate-limit filter
- Envoy repository and license