{"id":5959,"date":"2026-11-02T23:03:34","date_gmt":"2026-11-02T23:03:34","guid":{"rendered":"https:\/\/zynoo.com\/blog\/?p=5959"},"modified":"2026-11-02T23:04:36","modified_gmt":"2026-11-02T23:04:36","slug":"nginx-rate-limiting","status":"publish","type":"post","link":"https:\/\/zynoo.com\/blog\/nginx-rate-limiting\/","title":{"rendered":"How to Configure Nginx Rate Limiting on Ubuntu"},"content":{"rendered":"\n

Nginx rate limiting<\/strong> is a built-in feature that controls how many HTTP requests a client can make within a given period. It can reduce abusive traffic targeting APIs, login pages, and resource-intensive applications without requiring additional software.<\/p>\n\n\n\n

In this guide, you’ll configure Nginx request limits, test them safely, and enable protection on an Ubuntu server.<\/p>\n\n\n\n

<\/span>How Does Nginx Rate Limiting Work?<\/span><\/h2>\n\n\n\n

Nginx uses the limit_req<\/code> module to track incoming requests, commonly by client IP address.<\/p>\n\n\n\n

For example, you can configure an average limit of five requests per second while allowing short bursts of traffic. Requests exceeding the permitted burst can then be rejected.<\/p>\n\n\n\n

This helps prevent excessive requests from overwhelming your application.<\/p>\n\n\n\n

Note:<\/strong> Rate limiting helps mitigate certain Layer 7 HTTP floods. It cannot stop large network-level DDoS attacks that saturate your connection.<\/p>\n\n\n\n

\"how<\/figure>\n\n\n\n

<\/span>Prerequisites<\/span><\/h2>\n\n\n\n

You’ll need an Ubuntu server with Nginx installed, SSH access with sudo privileges, and an existing website or application.<\/p>\n\n\n\n

\n

If you’re setting up Nginx for the first time, follow our Nginx reverse proxy tutorial<\/a>.<\/p>\n<\/div>\n\n\n\n

Before making changes, back up your existing website configuration.<\/p>\n\n\n\n

<\/span>Step 1: Define a Rate-Limiting Zone<\/span><\/h2>\n\n\n\n

Connect to your server through SSH.<\/p>\n\n\n\n

On a standard Ubuntu Nginx installation, create a new configuration file:<\/p>\n\n\n\n

sudo nano \/etc\/nginx\/conf.d\/rate-limit.conf<\/code><\/pre>\n\n\n\n
Add:<\/p>\n\n\n\n
limit_req_zone $binary_remote_addr zone=perip:10m rate=5r\/s;<\/code><\/pre>\n\n\n\n
This configuration uses the client’s IP address to track requests, allocates 10 MB for tracking data, and sets an average limit of five requests per second per IP.<\/p>\n\n\n\n
The limit_req_zone<\/code> directive must be placed inside Nginx’s http<\/code> context. The standard Ubuntu configuration includes conf.d<\/code> files there.<\/p>\n\n\n\n
Save the file.<\/p>\n\n\n\n
<\/span>Step 2: Enable Rate Limiting for Your Website<\/span><\/h2>\n\n\n\n
Open your existing Nginx website configuration:<\/p>\n\n\n\n
sudo nano \/etc\/nginx\/sites-available\/app.example.com<\/code><\/pre>\n\n\n\n
Replace the filename with your actual configuration.<\/p>\n\n\n\n
For an HTTP application running on port 3000, a protected API endpoint could look like this:<\/p>\n\n\n\n
location \/api\/ {\n    limit_req zone=perip burst=10 nodelay;\n    limit_req_status 429;\n    limit_req_dry_run on;\n\n    proxy_pass http:\/\/127.0.0.1:3000;\n}<\/code><\/pre>\n\n\n\n
Here’s what the important directives do:<\/p>\n\n\n\n