# Rate limiting & WAF

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/rate-limiting

Add rate limiting per caller and a web application firewall in front of public endpoints, so abuse is throttled before it reaches the code.

Usually comes after: [TLS & network policy](https://gradus.kazet.blog/tree/cloud-application/step/tls-and-network-policy).

## Prompt for your AI assistant

```
Add per-client rate limiting to the public endpoints of this application and configure a web application firewall or equivalent edge rules for common attack patterns, then check that link preview crawlers and search engines still get through.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt