# WAF + rate limits prod values (P7.SEC.02)

| Route | Throttle |
|-------|----------|
| Login | 10/min |
| Checkout pay | 20/min |
| Forms submit | 10/min |
| Analytics beacon | 120/min |
| Webhooks | 120/min |

WAF: challenge bot ASNs; block known bad paths; review monthly.