Match the exact registration path and the POST method, then choose a response your signup client can handle. An edge rule that returns an HTML challenge page can break a JavaScript client expecting JSON.
Keep the match narrow
(http.request.uri.path eq "/api/register" and http.request.method eq "POST")This illustrative Cloudflare expression scopes the rule to one submission route. Add the expected hostname when a zone serves several applications. Confirm available actions and counting periods for the account before configuring the rule.
Choose the action for the client
A browser navigation can display an interactive challenge. A fetch or XHR request expecting a JSON response cannot simply treat that HTML as a successful registration response. Cloudflare marks challenge responses with cf-mitigated: challenge; inspect the response when diagnosing a broken signup flow.
For an API-style flow, use an intentional rate-limit error that the frontend handles, or complete bot verification in the form before submission and validate it server-side. Do not assume adding a managed challenge to an API route is transparent to users.
Tune from observed traffic
- Measure legitimate registration attempts, retries, and validation failures.
- Choose a starting threshold and counting period supported by the platform.
- Test successful signups, repeated submissions, and exceeded-limit responses.
-
Review edge events and application results before tightening the rule.
-
Check users sharing a public IP, such as office or mobile-network users.
No single per-IP threshold fits every application. Shared networks can create false positives, while distributed automation can avoid an IP-only limit. Record the reason for the threshold and revisit it when traffic changes.
Keep application controls
Validate fields on the server, enforce application throttles, and verify an account before granting the intended access. Protect each important operation even when the edge allows the request. Use abuse metrics that avoid logging passwords, verification tokens, or unnecessary personal data.
Registration retries must not accidentally create duplicate accounts or send unlimited verification messages. Test the full response and retry behavior, not only whether the edge rule matches.
Start by checking what the signup client expects on a successful response and on a rate-limit response, then configure the narrow rule around that contract.
Reference: Cloudflare challenge-response documentation.