---
layout: post
title: "Add your first Appwrite Firewall rules to a new project"
description: "Use the two Firewall rules on the Appwrite Free plan to rate limit sign-in and cap API traffic, then see what they stop in the Console."
date: 2026-11-03
cover: /images/blog/add-your-first-appwrite-firewall-rules/cover.avif
timeToRead: 3
author: atharva
category: tutorials
featured: false
faqs:
  - question: "How many Firewall rules can I create on the Appwrite Free plan?"
    answer: "Free organizations can create 2 Firewall rules per project, and Pro and Scale organizations can create 50. See [Plan limits](/docs/products/firewall/rules#plan-limits)."
  - question: "What does Appwrite protect without any Firewall rules?"
    answer: "Every Appwrite Cloud plan includes always-on [DDoS mitigation](/docs/products/network/ddos), and Appwrite applies built-in [rate limits](/docs/advanced/security/rate-limits) to sensitive endpoints such as sign-in. Firewall rules add limits that you choose on top."
  - question: "Can a Firewall rule lock me out of the Appwrite Console?"
    answer: "No. Firewall never blocks the Appwrite Console, so you can always update or turn off a rule."
  - question: "How do I change a Firewall rule's limit later?"
    answer: "Open the rule's menu in the Firewall rules list, choose **Update**, and change its **Request limit** or **Interval (seconds)**."
---

Appwrite Firewall checks every request to your project before it reaches your API. With a couple of rules, you decide how often one address can sign in or call your API, while your users carry on as usual.

The Free plan includes two rules per project, and this guide uses both. By the end, sign-in has a limit of its own, the rest of your API has a broader one, and you can watch both at work in the Console.

You need an Appwrite project whose users sign in with an Appwrite client SDK, in the browser or in a mobile app. If you don't have a project yet, [create one in the Console](/sign-in).

# Step 1: Open Firewall

![Firewall page on a Free project with the Rules 0/2 counter, Create rule, and Add preset](/images/blog/add-your-first-appwrite-firewall-rules/firewall-free-empty.avif)

Open your project and select **Firewall** under **Protect** in the sidebar. The **Rules 0/2** counter at the top shows the two rules your plan includes.

Keep the resource selector on **API**, so your rules cover every request to your project's API.

# Step 2: Rate limit sign-in

![Create firewall rule wizard with Path starts with /v1/account/sessions, Method equals POST, and a rate limit of 10 per 600 seconds by IP address, next to the Estimated impact panel](/images/blog/add-your-first-appwrite-firewall-rules/rule-sign-in.avif)

Your first rule sets how often one address can try to sign in.

1. Click **Create rule**, set **Rule name** to `Rate limit sign-in`, and keep **Resource type** on **API**.
2. Add **Path** **Starts with** `/v1/account/sessions`, click **+**, and add **Method** **Equals** `POST`.
3. Under **Then**, choose **Rate limit**. Set **Request limit** to `10` and **Interval (seconds)** to `600`.
4. Keep **Strategy** on **Fixed window** and **Limit by** on **IP address**.
5. Keep **Priority** at `100` and click **Create rule**.

Each address can now sign in 10 times every 10 minutes. That's plenty for someone who mistypes a password, and it slows down anyone trying password after password.

**Signing users in from server code on Appwrite Sites?**

Set **Resource type** to **Sites**, select your site under **Resource ID**, and use your login route, such as `/login`, as the path.

# Step 3: Limit all API traffic

![Rate limit project API preset dialog with a request limit of 600 per minute and its estimated impact](/images/blog/add-your-first-appwrite-firewall-rules/preset-project-api.avif)

Your second rule caps every API request from one address, so no single client can page through your tables at full speed.

1. Click **Add preset** and choose **Rate limit project API**.
2. Keep **Request limit** at `600` per `1` **Minutes** and click **Create rule**.
3. In the rules list, open the new rule's menu, choose **Update**, set **Priority** to `200`, and click **Update**.

Rules run from the lowest priority number up, and each request counts toward the first rule it matches. At `200`, sign-in attempts meet your sign-in limit first, and everything else counts toward this one.

The counter now reads **Rules 2/2**.

# Step 4: See what your rules stop

![Firewall traffic overview for the last hour, with Rate limited requests next to Passed requests](/images/blog/add-your-first-appwrite-firewall-rules/traffic-overview.avif)

The chart above your rules shows your project's traffic and what Firewall did with it. Requests over one of your limits appear under **Rate limited**, next to **Passed**.

With everyday use, **Rate limited** stays close to zero. When it rises, your rules are slowing down a client that sent more requests than you allow.

# Keep building

Your project now has its own limits on sign-in and on API traffic. As real users arrive, open a rule with **Update** and tune its limit to match your traffic.

On Pro, each project gets 50 rules, with room for the **Rate limit OTP** preset for SMS sign-in, **Attack mode** for your sites, and bypass rules for addresses you trust.

- [12 Appwrite Firewall rules to stop attacks](/blog/post/appwrite-firewall-use-cases)
- [Choosing a rate limit strategy](/blog/post/firewall-rate-limit-strategies)
- [Firewall documentation](/docs/products/firewall)
- [Rule priority](/docs/products/firewall/priority)
- [Traffic overview](/docs/products/firewall/monitor)