


How to implement rate limiting to prevent brute-force attacks (limit_req_zone)?
Jun 27, 2025 am 12:02 AMWhat is limit_req_zone and why it matters: limit_req_zone is an Nginx directive that sets up a shared memory zone to track client request rates, typically based on IP address, and blocks clients who exceed a defined rate, helping prevent brute-force attacks. How to configure it: 1. Define a zone using $binary_remote_addr for IP tracking; 2. Set the zone name and memory size (e.g., zone=one:10m); 3. Specify the rate limit (e.g., rate=1r/s); 4. Apply the zone in a location block with burst allowance (e.g., burst=5). Fine-tuning tips: Use different zones for different endpoints like /login and /api, applying stricter limits where needed, and combine rate limiting with CAPTCHA or account lockouts for enhanced security.
When it comes to protecting web services from brute-force attacks, one effective method is using rate limiting. The limit_req_zone
directive in Nginx allows you to control how frequently a client can make requests, which helps prevent abuse like login attempts or API overuse.
What is limit_req_zone
and why it matters
Nginx’s limit_req_zone
sets up a shared memory zone that tracks request rates per key, usually based on IP address. If a client exceeds the allowed number of requests in a set time frame, Nginx will respond with an error (typically 503 Service Unavailable). This mechanism is crucial for slowing down or blocking brute-force attempts before they become a real threat.
For example, if someone tries to guess passwords by hitting your /login
endpoint hundreds of times, rate limiting can block them after a few failed attempts, without affecting normal users.
How to configure limit_req_zone
To use limit_req_zone
, you need to define a zone in your Nginx configuration. Here's a basic setup:
http { limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s; server { location /login { limit_req zone=one burst=5; proxy_pass http://backend; } } }
Let’s break this down:
$binary_remote_addr
means we’re tracking clients by their IP address.zone=one:10m
creates a shared memory zone named “one” with 10MB of space—enough to store about 160,000 IPv4 addresses.rate=1r/s
limits each client to one request per second.- In the location block,
burst=5
allows bursts of up to 5 requests before rate limiting kicks in.
This setup lets real users try a few logins quickly (like when they mistype a password), but blocks automated scripts trying hundreds of attempts.
Fine-tuning rate limits for better protection
You might want different rules for different endpoints. For example, /login
should be more strictly limited than a public homepage. You can create multiple zones:
limit_req_zone $binary_remote_addr zone=login_limit:10m rate=10r/m; limit_req_zone $binary_remote_addr zone=api_limit:10m rate=60r/m;
Here:
login_limit
allows only 10 requests per minute (about 1 every 6 seconds), which is very strict and good for login pages.api_limit
allows 60 requests per minute (1 per second), suitable for general API usage.
You can then apply these zones selectively:
location /login { limit_req zone=login_limit burst=3; } location /api { limit_req zone=api_limit burst=20; }
Also consider combining rate limiting with other protections like CAPTCHA or account lockouts after repeated failures. That way, even if someone bypasses rate limits slightly, there are still barriers in place.
And that’s basically how you implement rate limiting with limit_req_zone
to protect against brute-force attacks. It’s not overly complex, but it does require careful tuning based on your service’s needs.
The above is the detailed content of How to implement rate limiting to prevent brute-force attacks (limit_req_zone)?. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

The main Nginx configuration file is usually located in the conf directory under /etc/nginx/nginx.conf (Ubuntu/Debian, CentOS/RHEL), /usr/local/etc/nginx/nginx.conf (macOSHomebrew) or the source code installation path; you can view the loaded configuration path through nginx-t, ps-ef|grepnginx check the path specified by the startup parameters, or use find/-namenginx.conf and locatenginx.conf to quickly find; the configuration file structure includes global settings, events blocks and http blocks, and common site configurations are common.

When Nginx experiences a "Toomyopenfiles" error, it is usually because the system or process has reached the file descriptor limit. Solutions include: 1. Increase the soft and hard limits of Linux system, set the relevant parameters of nginx or run users in /etc/security/limits.conf; 2. Adjust the worker_connections value of Nginx to adapt to expected traffic and ensure the overloaded configuration; 3. Increase the upper limit of system-level file descriptors fs.file-max, edit /etc/sysctl.conf and apply changes; 4. Optimize log and resource usage, and reduce unnecessary file handle usage, such as using open_l

Enabling Gzip compression can effectively reduce the size of web page files and improve loading speed. 1. The Apache server needs to add configuration in the .htaccess file and ensure that the mod_deflate module is enabled; 2.Nginx needs to edit the site configuration file, set gzipon and define the compression type, minimum length and compression level; 3. After the configuration is completed, you can verify whether it takes effect through online tools or browser developer tools. Pay attention to the server module status and MIME type integrity during operation to ensure normal compression operation.

The stub_status module displays the real-time basic status information of Nginx. Specifically, it includes: 1. The number of currently active connections; 2. The total number of accepted connections, the total number of processing connections, and the total number of requests; 3. The number of connections being read, written, and waiting. To check whether it is enabled, you can check whether the --with-http_stub_status_module parameter exists through the command nginx-V. If not enabled, recompile and add the module. When enabled, you need to add location blocks to the configuration file and set access control. Finally, reload the Nginx service to access the status page through the specified path. It is recommended to use it in combination with monitoring tools, but it is only available for internal network access and cannot replace a comprehensive monitoring solution.

The "Addressalreadyinuse" error means that another program or service in the system has occupied the target port or IP address. Common reasons include: 1. The server is running repeatedly; 2. Other services occupy ports (such as Apache occupying port 80, causing Nginx to fail to start); 3. The port is not released after crash or restart. You can troubleshoot through the command line tool: use sudolsof-i:80 or sudolnetstat-tulpn|grep:80 in Linux/macOS; use netstat-ano|findstr:80 in Windows and check PID. Solutions include: 1. Stop the conflicting process (such as sudos

The main difference between NginxPlus and open source Nginx is its enhanced functionality and official support for enterprise-level applications. 1. It provides real-time monitoring of the dashboard, which can track the number of connections, request rate and server health status; 2. Supports more advanced load balancing methods, such as minimum connection allocation, hash-based consistency algorithm and weighted distribution; 3. Supports session maintenance (sticky sessions) to ensure that user requests are continuously sent to the same backend server; 4. Allow dynamic configuration updates, and adjust upstream server groups without restarting the service; 5. Provides advanced cache and content distribution functions to reduce backend pressure and improve response speed; 6. Automatic configuration updates can be achieved through APIs to adapt to Kubernetes or automatic scaling environments; 7. Includes

A/B testing can be implemented through Nginx's split_clients module, which distributes traffic proportionally to different groups based on user attribute hashing. The specific steps are as follows: 1. Use the split_clients instruction to define the grouping and proportions in the http block, such as 50%A and 50%B; 2. Use variables such as $cookie_jsessionid, $remote_addr or $arg_uid as hash keys to ensure that the same user is continuously allocated to the same group; 3. Use the corresponding backend through if conditions in the server or location block; 4. Record the grouping information through a custom log format to analyze the effect; 5. Track the performance of each group with the monitoring tool

To implement complex variable mapping, you can use map to combine other operations for dynamic transformation. 1. The basic usage of map is to apply functions to each element, such as squared lists; 2. You can pair multiple lists by position to generate dictionaries with zip; 3. Use custom functions to process logical mappings, such as safely converting data types or obtaining permissions based on roles; 4. Use tools such as filter or reduce to build an efficient data conversion process. These methods can flexibly respond to changing mapping needs.
