Security nginx Advanced

Nginx Rate Limiting Config

Per-IP rate limiting in Nginx: burst allowed, delay enforced, login endpoint hardened.

nginx
limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=login:10m   rate=5r/m;

server {
  location / {
    limit_req zone=general burst=20 nodelay;
  }
  location /api/login {
    limit_req zone=login burst=3 nodelay;
    limit_req_status 429;
  }
}

Prerequisites

  • Nginx >= 1.18

Pro Tips

  • → Return 429 with Retry-After header using add_header.

Was this module useful?

Share your experience — it helps the team improve.

Leave Feedback

Commercial Licensing

Acquire a production access token or template license for enterprise deployment.

Module Info

Language
nginx
Level
Advanced
Read time
3 min
Published
Jan 2026
License
Commercial License

Newsletter

New modules every week, directly to your inbox.