--- title: "Per-IP rate limit on Cloudflare free plan - the gotchas" slug: cloudflare-rate-limiting-free-plan-tricky date_published: 2026-02-27T18:00:00.000Z original_url: https://www.tigzig.com/post/cloudflare-rate-limiting-free-plan-tricky source: fresh processed_at: 2026-02-27T18:00:00.000Z --- # Per-IP rate limit on Cloudflare free plan - the gotchas ![Cloudflare Rate Limiting](/images/blog/security_02.png) 1st issue - if you are on Vercel, every app gets a public something-something.vercel.app URL alongside your custom domain. Bypasses Cloudflare - all your rules gone down the drain. What do you do? Just enable deployment protection and any access to that URL would go to Vercel's sign in page. Matter over. No not.. not done yet ...what if you have a FastAPI backend on a different URL? Or different subdomain for different apps e.g vigil.tigzig.com, qrep.tigzig.com etc. Or you have MCP Servers ...each on a different URL requiring a different rate limit? Then it gets tricky. Why? Only 1 rule on free account with single rate limit (per 10s). And Cloudflare's $20 Pro plan gets you 2 rules only. Yupp .. you can just combine them into a single rule if that works.. I have some 60+ subdomains across my 40+ apps and their respective backends .. now hacking something together with Cloudflare workers. Claude Code has number of ideas .. one enthu cutlet .. after each idea asks 'Shall I go ahead and implement this'? no baba .. need to understand what you going to do... But THE MOST IMPORTANT POINT - for a single domain or if you can combine them then do make sure to use Cloudflare. Doesn't cost anything and the protection and functionalities it provides even on free tier is huge. 80 items now on my security checklist at [tigzig.com/security](https://tigzig.com/security) Vulnerabilities I've detected and fixing across 40+ of my deployed apps. Full markdown copy available - paste it to your AI coder as a starting checklist or have it walk you thru it. ## Related Tools: [TREMOR - Macro Stress Signals](https://www.tigzig.com/tremor), [Quants Agent](https://www.tigzig.com/n8n-tech-analysis) Explore: [Security checklist](https://www.tigzig.com/security), [Browse the apps](https://www.tigzig.com/browse-apps), [Build guides](https://www.tigzig.com/blog) More posts: [2026 Infra Guide for AI Tool Builders - Part 5: Perimeter Security on Cloudflare (Free Plan)](https://www.tigzig.com/post/perimeter-security-cloudflare-free-plan), [Are You Rate Limiting the Wrong IPs? A SlowAPI Story.](https://www.tigzig.com/post/are-you-rate-limiting-the-wrong-ips), [Upstash Redis on Vercel - The Tool I Didn't Know I Needed](https://www.tigzig.com/post/upstash-redis-vercel-rate-limiting), [My Public MCP Server Got Hammered - Security Lessons from a Bot Attack](https://www.tigzig.com/post/mcp-server-bot-attack-security-lessons) --- Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar Source: https://www.tigzig.com/post/cloudflare-rate-limiting-free-plan-tricky Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar. License: https://www.tigzig.com/terms