Rate limiting: your own limits per address

You can find rate limiting under Edge › Security. A rule says: on this address, with this method, at most this many requests per IP address in this amount of time. Above that, the edge blocks them or only measures.

With one click

• Login: after 5 login attempts per minute, blocked for fifteen minutes.
• XML-RPC: after 3 per minute, blocked for an hour.
• API (wp-json): at most 120 per minute.
• Site search: at most 20 searches per minute.
• Comments: after 5 comments per minute, blocked for an hour.
• Checkout (WooCommerce): against card testers, closed for half an hour after 10 attempts per minute.

Create your own rule

Choose a name, the address (starts with, is exactly, or contains), the method (GET, POST, etc.; if nothing is ticked, all methods apply), how many requests per how much time, and what happens above that. Below the form, one sentence explains what the rule does. You turn a rule on or off with the toggle.

What visitors see

A clean “Take it easy” page that shows how long it will last. Real search engines, Netslim itself and your admin IPs are never counted.

Review

For each rule, you see how often it was hit in the past 30 days. In the events above, every hit is listed as “Rate limit: name of the rule”.