Announcing Rate Limiting Expansion for Next-Gen WAF

Today we’re excited to announce an expansion of advanced rate limiting rules, increased blocking durations, and removal of limitations on non-IP client identifiers. We’re also opening up our edge rate limiting to customers on our Professional security package. Fastly offers rate limiting in a few different places to thwart abusive traffic as well as high rate DDoS attacks.

Thwarting Abusive Traffic

Rate limiting is a method of limiting network traffic to help protect your websites, APIs, and general infrastructure from being overloaded. Typically it’s used to mitigate abuse or misuse but it can also be used to lessen the impact of a misconfigured client. Alternatively, rate limiting can be used as a tool to protect components of your site that are fragile or incapable of handling a sudden influx of traffic.

We’ve heard your feedback on wanting more rate limiting rules along with flexible client identifiers to allow for pinpoint accuracy when it comes to identifying malicious users. We know you also require granular control over blocking durations for each microservice within your web application.

Starting today, for Premier package customers, we have bumped up the number of rate limit rules from 10 to 15, and removed the restriction on non-IP client identifiers. We are also providing further flexibility regarding rate-limiting durations by allowing you to rate limit attackers for up to 24 hours. The extended block time helps in cases where attackers keep using the same attack tooling for extended periods of time.

Stopping High-rate DDoS at the Edge

Advanced rate limit rules in the Fastly Nex-Gen WAF provide protection based on signals, but sometimes you need to stop excessive traffic bursts farther from your application. These so-called “cache-busting” attacks skip the inherent protection offered by Fastly’s caching layer and can overwhelm back-end applications - taking your entire service or API offline. For these types of attacks, Fastly offers edge rate limiting which is now available for Professional package customers who also utilize Fastly Delivery. Edge rate limiting offers fast time to detection (TTD) – as fast as one second – to help put the brakes on high rate traffic bursts.

Finally, customers in both the Professional and Premier packages now have access to 200 signals per site as well as per corp.

Next steps

If you are currently a Fastly Next-Gen WAF customer, you have access to the above-mentioned improvements within your security package tier today. If you’re not a customer, reach out to us to see how our rate limiting capabilities can stop abusive traffic from impacting your sites and APIs.

Daniel Corbett
Staff Product Manager

2 min read

Want to continue the conversation?
Schedule time with an expert
Share this post
Daniel Corbett
Staff Product Manager

Daniel Corbett is a Staff Product Manager on the Security Product team, where he works on the Signals and Rules that power Fastly's Next-Gen WAF. He has over 15 years of security practitioner experience and has previously worked at a high-traffic managed hosting provider where he was architecting and building secure infrastructure, mitigating threats and attacks of varying degrees, and performing incident response. Daniel is a passionate teacher and mentor who enjoys helping others. When he's not working you can find him spending time with his family, working on home improvement projects, or trying to duplicate meals from his favorite restaurants.

Ready to get started?

Get in touch or create an account.