Cloudflare has three different limits that can affect screenshot traffic: the quota for calls to Cloudflare’s own API, the Browser Rendering REST quota, and a WAF rate-limiting rule that you configure for visitors to your screenshot endpoint. Protect your route with the WAF rule; do not use Cloudflare’s 1,200-requests-per-five-minutes API quota as your application threshold.
Decide which limit you are configuring
Before changing anything, identify where requests are being limited:
| Control | What it limits | Who sets it |
|---|---|---|
| Cloudflare client API quota | Requests made to Cloudflare’s dashboard and API | Cloudflare service |
| Browser Rendering REST quota | Browser Run quick-action calls such as /screenshot |
Cloudflare service, according to plan |
| WAF rate-limiting rule | Incoming requests to your zone, such as /api/screenshot |
You, through the Rulesets API or dashboard |
Cloudflare’s API limits page, updated Aug. 25, 2026, lists a client limit of 1,200 requests per five-minute period per user or account token and a separate limit of 200 requests per second per IP. The global five-minute limit is cumulative across dashboard, API-key and API-token activity; after it is exceeded, API calls are blocked for the next five minutes. Those figures govern administration calls to Cloudflare, not visitors requesting screenshots from your application.
Cloudflare announced on March 4, 2026 that Browser Rendering REST limits for Workers Paid plans increased from 3 requests per second (180 per minute) to 10 requests per second (600 per minute), including the /screenshot quick action. Confirm that your plan and interface qualify before relying on that entitlement.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Design the rule before writing it
Match only the screenshot route
Use an expression that identifies the route and, where possible, the host. A narrow expression prevents unrelated pages from sharing the counter. For example:
(http.host eq "images.example.com" and http.request.uri.path eq "/api/screenshot")Add a method test such as http.request.method eq "POST" only when the field is available in your plan and your endpoint uses a single method. Cloudflare plan availability for expression fields differs.
Choose a fair counter identity
The characteristics array determines which requests share a counter. Cloudflare requires cf.colo.id and supports values such as source IP and request-header values. Source IP is simple, but office networks, mobile carriers and proxies can combine unrelated customers. If every caller has an API key, counting by that header is usually fairer. Decide what happens when the header is missing; otherwise anonymous traffic may share an unintended bucket.
Set period and threshold from traffic data
period is the evaluation interval in seconds and requests_per_period is the trigger count. Measure legitimate concurrency, normal bursts, rendering time and your provider’s capacity first. Cloudflare’s published values of 100 requests in 60 seconds and a 600-second mitigation timeout illustrate syntax only; they are not a recommendation for a screenshot service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Select mitigation behavior
block returns a denied response after the threshold is reached. A custom response can be attached to a block action. Depending on plan and configuration, challenge or eligible throttling behavior may also be available. mitigation_timeout controls how long mitigation remains active after a trigger.
Decide what counts
By default, the counting expression follows the rule expression. A custom counting expression can count only a subset of matched requests. The requests_to_origin setting controls whether requests reaching origin are counted in applicable configurations. Check whether cached and uncached screenshot responses should share a counter; otherwise cache behavior can make observed usage differ from origin load.
Create a zone-level rate-limit rule with the Rulesets API
- Prepare credentials. Create a Cloudflare API token with the permissions required for Rulesets changes on the target zone. For Browser Rendering REST calls, Cloudflare documents a custom token with Browser Rendering – Edit; keep that permission separate from your WAF deployment token when practical.
- Retrieve the entry-point ruleset. Query the zone’s
http_ratelimitphase entry-point ruleset. If it exists, record its ruleset ID and current version. - Create it when absent. If no entry-point ruleset exists, create one in the
http_ratelimitphase with your rate-limit rule included. - Append the rule. When updating an existing ruleset, preserve its current rules and place the rate-limit rule at the end of the rules array, as Cloudflare requires.
- Verify and observe. Send controlled requests, inspect responses and analytics, and then tune the threshold from real traffic.
The rule object has this shape. Replace the route, characteristics and numbers with values from your workload:
{
"description": "Rate limit screenshot requests",
"expression": "(http.host eq "images.example.com" and http.request.uri.path eq "/api/screenshot")",
"action": "block",
"ratelimit": {
"characteristics": ["cf.colo.id", "ip.src", "http.request.headers["x-api-key"]"],
"period": 60,
"requests_per_period": 100,
"mitigation_timeout": 600
}
}A typical API update uses a bearer token and a zone Rulesets endpoint. Keep the existing rules in the request and append the object above:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
curl -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/$RULESET_ID"
-H "Authorization: Bearer $CF_API_TOKEN"
-H "Content-Type: application/json"
--data @ruleset-update.jsonUse the response’s success field and returned ruleset version as your deployment check. Do not overwrite rules you did not retrieve first.
Account-level deployment
Cloudflare’s account-level procedure creates a custom rate-limiting ruleset in the http_ratelimit phase, then deploys it through the account phase entry-point ruleset with an execute rule. The documented procedure is restricted to Enterprise zones; its example includes cf.zone.plan eq "ENT". Check the target account’s plan before adopting this pattern.
Cloudflare lists Account WAF Write or Account Rulesets Write among the permissions used for account-level changes. Scope the token to only the accounts and operations required.
Test without locking out real users
- Start with a staging hostname or a temporary expression containing a test header.
- Use one API key and one source IP to confirm that requests share the intended counter.
- Use a second key from the same IP to verify whether keys, rather than IPs, separate callers.
- Remove the test header and verify anonymous requests follow your documented policy.
- Check cached and uncached URLs if your screenshot system caches responses.
- Test just below and above the threshold, then wait through the mitigation timeout.
Expect approximate enforcement. Cloudflare states that rate-limit counters can take a few seconds to update, so excess requests may reach origin before mitigation. Its documentation says: “Rate limiting rules are not designed to allow a precise number of requests to reach your origin server.” Some Enterprise customers may have throttling above the configured maximum, depending on plan or add-on.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Troubleshoot common failures
The rule never matches
Check the hostname, path normalization, HTTP method and escaping in the expression. Confirm that the request reaches the zone where the ruleset is installed and that the rule is in the http_ratelimit phase.
Unrelated users are blocked together
Your characteristics are too coarse, commonly because they contain only ip.src. Add a caller key or another supported identity value, and define behavior for missing headers.
The API update is rejected
Retrieve the current ruleset first, preserve required fields and append the rate-limit rule last. Verify token scope, zone ID, phase name and JSON types. A token that can call Browser Rendering is not automatically authorized to modify WAF rules.
Requests bypass the expected count
Review the counting expression, cache status and requests_to_origin behavior. A cached response may not be counted the same way as an origin request in your configuration.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
More than the threshold reaches origin
This is expected during counter propagation. Lower the operational risk with origin-side authentication, a queue or an application-level limit; do not promise an exact hard ceiling based solely on WAF enforcement.
Cloudflare API calls return rate-limit errors
Inspect Ratelimit, Ratelimit-Policy and retry-after response headers. Back off until the indicated window resets. Remember that dashboard, API-key and API-token activity contributes to the 1,200-per-five-minute client quota.
Operational and cost guidance
- Log the caller identity, rule outcome, response code and rendering duration, while avoiding sensitive screenshot URLs in logs.
- Alert on sustained near-threshold traffic, sudden increases in blocked requests and origin saturation.
- Use a shorter period to control bursts and a longer mitigation timeout to discourage repeated abuse; validate both against legitimate batch jobs.
- Separate limits for authenticated customers, anonymous users and internal automation when their capacity or abuse risk differs.
- Recheck plan documentation before using account-level rules, custom fields, throttling or advanced counting options.
Or skip the browser setup
If you need the screenshot service rather than a browser-rendering deployment, ScreenshotNeo provides a single HTTP request and an MCP server for AI agents. It removes cookie-consent banners, newsletter popups and chat widgets before capture. Bot checks, blank pages, failed loads and timeouts are not billed, and each response reports the page verdict and billing status.
cURL:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);See the ScreenshotNeo API documentation for capture options. An MCP server exposes take_screenshot, get_page_info and capture_pdf to Claude, Cursor and other MCP clients. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 screenshots. Create a free ScreenshotNeo account.
Frequently Asked Questions
Should I rate-limit Cloudflare API calls or my screenshot endpoint?
Rate-limit the incoming screenshot endpoint with a WAF rule. Cloudflare’s client API quota is a separate service limit for administrative API traffic.
Can I guarantee that exactly the configured number of requests will reach origin?
No. Cloudflare documents that counters can lag by a few seconds, so enforcement is approximate.
When is an account-level ruleset appropriate?
Use it when one policy must span zones and your account meets Cloudflare’s plan and permission requirements; the documented account procedure is for Enterprise zones.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
