---
title: Limit Abuse with Rate Limiting
description: Learn how to protect your authentication endpoints against abuse.
url: /kb/guide/limit-abuse-with-rate-limiting
canonical_url: "https://vercel.com/kb/guide/limit-abuse-with-rate-limiting"
published: 2025-11-03
last_updated: 2025-11-11
authors: DX Team
related:
  - /docs/security/vercel-waf/examples
  - /docs/security/vercel-waf/custom-rules
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---
<!-- docsgraph:related -->
## Related pages

> **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below.

- [Examples](https://vercel.com/docs/vercel-firewall/vercel-waf/examples?from=related) — Learn how to use Vercel WAF to protect your site in specific situations.
- [Rate Limiting](https://vercel.com/docs/vercel-firewall/vercel-waf/rate-limiting?from=related) — Learn how to configure custom rate limiting rules with the Vercel Web Application Firewall \(WAF\).
- [Rate Limiting SDK](https://vercel.com/docs/vercel-firewall/vercel-waf/rate-limiting-sdk?from=related) — Learn how to configure a custom rule with rate limit in your code.
- [Custom Rules](https://vercel.com/docs/vercel-firewall/vercel-waf/custom-rules?from=related) — Learn how to add and manage custom rules to configure the Vercel Web Application Firewall \(WAF\).
- [Web Application Firewall](https://vercel.com/docs/vercel-firewall/vercel-waf?from=related) — Learn how to secure your website with the Vercel Web Application Firewall \(WAF\)
- [Add Rate Limiting with Vercel](https://vercel.com/kb/guide/add-rate-limiting-vercel?from=related) — Learn how to implement rate limiting with Vercel
- [Securing your AI applications with Rate Limiting](https://vercel.com/kb/guide/securing-ai-app-rate-limiting?from=related) — Learn how to secure your AI applications with rate limiting using Vercel WAF and Vercel AI SDK
- [Suspicious Traffic in Specific Countries](https://vercel.com/kb/guide/suspicious-traffic-in-specific-countries?from=related) — Learn how to block traffic in specific geographical regions.
- [Block PHP requests](https://vercel.com/kb/guide/block-php-requests?from=related) — Learn how to block traffic looking for .php vulnerabilies.
- [Blocking traffic from a specific IP address.](https://vercel.com/kb/guide/traffic-spikes?from=related) — Learn how to block traffic from a specific IP address.

Full cross-link map for this page: [/kb/guide/limit-abuse-with-rate-limiting.graph.md](/kb/guide/limit-abuse-with-rate-limiting.graph.md)
<!-- /docsgraph:related -->


**Scenario**: After setting up authentication in your application, you would like to protect it against brute force attacks and other forms of abuse. To do so, you add a rate limiting rule for preventing abuse on the registration and login endpoints.

1. Select your project from the Vercel [dashboard](/dashboard) and select the **Firewall** tab
   
2. From the top right corner of the Firewall page, click the **Configure** button and then **\+ New Rule**
   
3. For the **Name**, enter "Auth Abuse Prevention"
   
4. For the **Description**, enter "Limits requests to registration and login endpoints to prevent abuse and brute force attacks"
   
5. In the **Configure** section, set up the following **If** condition:
   
   The [Perl Compatible Regular Expression (PCRE)](https://www.pcre.org/) used is:
   
   - `^/api/auth/(?:register|signup|login|signin)$`
     
   
   It can be broken down as follows:
   
   - `^/api/auth/`: Matches the beginning of the request path, ensuring it starts with `/api/auth/`
     
   - `(?:register|signup|login|signin)`: Matches either `register`, `signup`, `login`, or `signin`
     
   - `$`: Ensures the pattern matches to the end of the request path
     
6. For the **Then** action, select **Rate Limit**
   
7. Select **Fixed Window** for the limiting strategy with the following values:
   
   - 60s for the **Time Window**
     
   - 10 for the **Request Limit**
     
   - IP Address as the key for the request source match
     
8. For the rate limiting **Then** action, choose **Deny**
   
9. Select **Save Rule**
   
10. Apply the changes:
    
    - When you make any change, you will see a **Review Changes** button appear or update on the top right with the number of changes requested
      

- Select **Review Changes** and review the changes to be applied
  
- Select **Publish** to apply the changes to your production deployment
  

This rule will apply to endpoints like `/api/auth/register`, `/api/auth/signup` and `/api/auth/login`, and will block any specific IP that tries to perform more than 10 requests in 60 seconds. This will prevent individual attackers from abusing these endpoints.

For distributed attacks, you can create a second rule with a similar configuration except for the following values:

- 100 for the **Request Limit**
  
- User agent as the key for the request source match
  

This will limit requests from specific types of clients.

## Related

- [Suspicious Traffic in Specific Countries](/guides/suspicious-traffic-in-specific-countries)
  
- [Emergency redirect](/guides/emergency-redirect)
  
- [WAF Examples](/docs/security/vercel-waf/examples)
  
- [WAF Custom Rules](/docs/security/vercel-waf/custom-rules)