Nginx Rate Limiting Configuration

Nginx's limit_req_zone and limit_req directives let you cap requests per IP or key. Use our generator to create the correct shared memory zone and apply it to any location block.

Zone and limit

Define a shared-memory zone keyed by client address in the http block, then apply it in a location.

limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
server {
    location /api/ {
        limit_req zone=api burst=20 nodelay;
        limit_req_status 429;
    }
}

Burst and nodelay

burst allows short spikes above the rate. nodelay serves the burst immediately instead of spacing requests out; requests beyond the burst are rejected.

Open the Rate limiting generator

Frequently asked questions

Which status code should rate limiting return?

429 Too Many Requests. Nginx defaults to 503, so set limit_req_status 429.

Why does limiting not work behind a CDN?

$binary_remote_addr is the CDN address. Use the real client IP via the realip module before the limit is evaluated.

Guides

• Nginx Reverse Proxy Configuration
• Caddy Reverse Proxy Configuration
• Nginx Static Site Configuration
• Caddy Static Site Configuration
• Nginx + PHP-FPM Configuration
• Caddy + PHP-FPM Configuration
• Nginx SSL/TLS Configuration
• Nginx Load Balancer Configuration
• Caddy Load Balancer Configuration
• Nginx Rate Limiting Configuration
• Nginx Security Headers Configuration
• Caddy Security Headers Configuration
• Nginx Gzip Compression Configuration
• Nginx Caching Configuration
• Caddy HTTPS Redirect Configuration
• Nginx WebSocket Proxy Configuration
• Nginx Content-Security-Policy Header
• Block Bad Bots and Scanners in Nginx
• fail2ban for Nginx
• nginx.conf Best Practices
• Nginx Location Regex Tester
• Deploy Nginx Config with GitHub Actions
• Nginx CORS Headers Configuration
• Nginx Cache-Control Headers Configuration
• Nginx 301 Redirect Map Configuration
• robots.txt, Sitemap and security.txt
• Apache .htaccess Configuration
• Docker Compose and Dockerfile Configuration
• systemd Service and Timer Configuration
• Cron Expression Explainer
• SSH Hardening with sshd_config
• Linux Firewall Rules: ufw, nftables and iptables
• Glob Pattern Tester
• Analysing Nginx Access Logs with awk
• Subnet Mask and CIDR Calculator
• VLAN Configuration on Linux
• Static Routes and Policy Routing on Linux
• NAT and Port Forwarding with nftables
• DHCP Server Configuration
• BIND Zone File Example
• WireGuard Server and Client Configuration
• A Simple IP Plan for Your Home Network