How to limit abusive traffic with Nginx (rate limiting)

Rate limiting stops a single IP from making thousands of requests and overloading the server. Nginx has this feature built in.

1. Define a limit zone

In /etc/nginx/nginx.conf, inside the http block:

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;

Allows 10 requests per second per IP.

2. Apply the limit

In a server block or a specific location (e.g. the login page):

location /login {
    limit_req zone=mylimit burst=20 nodelay;
    proxy_pass http://127.0.0.1:3000;
}

3. Reload

nginx -t && systemctl reload nginx

4. Also limit concurrent connections

limit_conn_zone $binary_remote_addr zone=conn:10m;
limit_conn conn 20;

Limitations

Rate limiting stops small abuse, but not a large DDoS attack, which needs network-level protection. Combine with fail2ban and a firewall.