# Changelog

> Changes to WAF, newest first.

- 2026-10-25 [Rate limiting rules](https://developers.openwaf.dev/changelog/2026-10-25-rate-limiting-rules/index.md): Up to 25 rate limiting rules per site, per path and keyed by IP, header, cookie or JSON body field, with block, challenge or log.