Rate Limit Rule Affecting Everyone

[basedappsandgames]

What is the name of the domain?

whatbeatsrock.com

What is the issue you’re encountering

I am creating a custom rule for 2000 requests/10secs on startsWith: whatbeatsrock.com/api/vs should be blocked. However, it is affecting me on ONE request.

Was the site working with SSL prior to adding it to Cloudflare?

Yes

What is the current SSL/TLS setting?

Full

What are the steps to reproduce the issue?

I turn on my rate limit rule and then go to my site and do an action that triggers the endpoint, and I immediately get blocked.

[sjr]

@basedappsandgames

startsWith: whatbeatsrock.com/api/vs

If that’s using the field URL Full you’ll need to include https:// if using starts with. Look at the example under the box.

Otherwise, can you show a screenshot of the rule?

@basedappsandgames

What is the current SSL/TLS setting?

Full

Use “Full (strict)” so Cloudflare validates your origin server certificate to ensure your connection is fully secured.

[basedappsandgames]

yes i do have the https:// sorry i didn’t put it in my original details. will turn on Strict mode.

[sjr]

Check your security event log to see if this is the rule that’s actually blocking you, and if not, why…
https://dash.cloudflare.com/?to=/:account/:zone/security/events

[basedappsandgames]

yes that is the one blocking me. there are no other rules blocking at that time.

[marcin.kubica]

Hi @basedappsandgames
try it maybe like this

or add www when your analytics section shows it as a www.whatbeatsrock.com

[sdayman]

Your rule says it would return a 429. When I request that URL with curl, I get a 403. With a browser, I get a 405.

[basedappsandgames]

seems to have solved itself somehow just by waiting