Rate limits and proof-of-work

Defaults per service

Setting	Default	Effect when exceeded
conn_drop_per_10s	500 connections	silent drop before TLS
conn_per_10s	50 connections	429
req_per_10s	500 requests	429
challenge_req_per_10s	200 requests	proof-of-work challenge
path_default	1000 requests per path	429
JA4 rate	1000 requests per fingerprint per 10 s	challenge (or deny)
slow HTTP	under 1024 bytes per 10 s	challenge

All counters are per source IP and synchronised across the edge cluster. Raise or lower them per service in the portal; per-path limits go into protection rules.

Proof-of-work

Suspicious clients get an Argon2 challenge that a browser solves in milliseconds and a bot farm pays for in CPU time. Settings: difficulty (default 18), cookie lifetime after a solved challenge (default 24 hours), always_challenge for lockdown situations, and an exemption for known crawlers.

Machine clients (APIs, monitoring, webhooks) cannot solve the challenge. Give them an allow rule on their path or source, see Protection rules.