Traffic
Rate limits and connection limits
The simplest protection against somebody hammering a login page guessing passwords, and against one badly written script using all of your capacity.
They are not the same thing
| Rate limit | Connection limit | |
|---|---|---|
| Caps | How many requests in a period. | How many conversations open at once. |
| Stops | Rapid fire requests, password guessing, scrapers. | One visitor holding hundreds of slow connections open. |
| Typical value | 10 requests a second | 10 connections |
The second one matters more than it looks. A small number of machines can tie up a server by opening many connections and reading each response very slowly, and they never look busy while they do it.
Making a rate limit
| Setting | What it does | Usual value |
|---|---|---|
| Name | What you pick it by on a site or a path. | login-limit |
| Counts by | What makes two requests count as the same visitor. | $binary_remote_addr |
| Rate | How many are allowed, per second or per minute. | 10r/s |
| Memory | Space for remembering visitors. 10m holds roughly 160,000 addresses. | 10m |
Set it well above what a real person does
Somebody reading a site makes a handful of requests a second while a page loads, so ten a second stops abuse without anybody noticing. Set it too low and real visitors get errors, which is a worse outage than the one you were protecting against, and harder to spot because most people just leave rather than complaining.
Connection limits
Same shape, simpler settings: a name, what counts as one visitor, and how much memory to give it.
Be careful with a low number
A browser opens several connections at once on purpose. A limit of one or two will break ordinary visitors on an ordinary website. Ten is a gentle starting point.
Put them on a path, not the whole site
A single limit across a whole site is a blunt instrument. Applying a strict limit to
/login and leaving the rest of the site alone protects the thing that needs
protecting and never inconveniences anybody reading an article. That is what
paths are for.
Test it before you rely on it
Ask for a page faster than the limit and confirm you get refused. Then confirm normal use does not. A limit nobody has tested is a setting, not a protection, and the two look identical right up until they do not.
Common questions
Do limits apply per node or across the fleet?
Per node, because the counters live in nginx shared memory on that box. With two nodes and traffic split between them, a visitor could get up to twice the configured rate in the worst case. Size the limit with that in mind.
What status code does a refused request get?
nginx returns 503 by default for a rate limit. If you have an error page template on the site, the visitor sees your page rather than the bare nginx one.
Should I rate limit behind a CDN?
Only if you are also trusting the real client address from a header, otherwise every request looks like it came from the CDN and you will limit the whole world at once.
Step by step instructions
The how to section has searchable, task shaped answers. Search it for rate limit.