Cloudflare
Security & compliance
Cost
Stability
No rate-limiting rules on the zone
Part of the WAF & rate limiting check · fix arrives as a guide
What it is
The zone has no rate-limiting rules configured.
Why it matters
Credential stuffing against your login endpoint looks like ordinary traffic without a limit, and a scripted loop against an expensive endpoint is a cost and availability problem. Nothing bounds how fast one client can hit you.
How to fix it
Add rate-limiting rules on authentication, password reset, and any expensive or paid endpoint. Rate-limit by IP and by a session or account identifier so a distributed attempt is still bounded per account.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.