check / check (push) Waiting to run
A request is neither counted nor refused by the request rate limits when the path the app will act on starts with one of the comma-separated prefixes in SWWAF_RATE_LIMIT_EXEMPT_PATHS. That path is the request's path percent-decoded, with its . and .. segments and repeated slashes resolved, so /assets/..%2Flogin is /login and is counted. The static lists, bans and the country lists still apply. The setting is empty by default, and a prefix that does not start with / stops the start. README.md documents it. Model: opus-5-5