Rate limit rules in the firewall

You can add a Rate limit action to a custom firewall rule. Each client gets a set number of requests per time window, and the rule acts on that client’s requests until the window ends. Rate limit rules match Vercel’s: fixed windows, the same counting keys, and a 429 with Retry-After by default.

Set a limit

Choose Rate limit under Then in the rule editor, then set:

• Requests allowed: a number of requests per fixed window of 10 seconds to 10 minutes
• Count by: IP address, TLS fingerprint (JA4), or IP and JA4
• When exceeded: Return 429 (the default) responds with 429 Too Many Requests and a Retry-After header; you can instead pick Challenge, Deny (403), or Log only

The rule editor previews the rule against recent requests, the same as other actions.

How counting works

Each edge region keeps its own counts. A client whose requests reach two regions can make up to the limit in each.

While a client is under the limit, the rule only counts the request and the rules below it still run. That’s different from other actions, where the first matching rule decides.

Start with Log only to see how often clients would go over the limit, then switch to Return 429.

Plans and billing

Hobby projects can have 1 rate limit rule and Pro projects 40. Requests a rate limit rule allows are billed as Rate Limiting. Limited requests aren’t billed.

See Rate limiting and Pricing.