# Rate limiting rules

> Up to 25 rate limiting rules per site, per path and keyed by IP, header, cookie or JSON body field, with block, challenge or log.

Sites can now limit requests per path with up to 25 rate limiting rules, each keyed by IP, header, cookie or a JSON body field, and answering with block, a proof-of-work challenge or log only. A name can have its own list instead of the domain's. Rules are managed from the dashboard (with templates for login and one-time-code forms), the CLI, the API and MCP.

See the [WAF documentation](https://developers.openwaf.dev/waf/).