


How to implement rate limiting to prevent brute-force attacks (limit_req_zone)?
Jun 27, 2025 am 12:02 AMWhat is limit_req_zone and why it matters: limit_req_zone is an Nginx directive that sets up a shared memory zone to track client request rates, typically based on IP address, and blocks clients who exceed a defined rate, helping prevent brute-force attacks. How to configure it: 1. Define a zone using $binary_remote_addr for IP tracking; 2. Set the zone name and memory size (e.g., zone=one:10m); 3. Specify the rate limit (e.g., rate=1r/s); 4. Apply the zone in a location block with burst allowance (e.g., burst=5). Fine-tuning tips: Use different zones for different endpoints like /login and /api, applying stricter limits where needed, and combine rate limiting with CAPTCHA or account lockouts for enhanced security.
When it comes to protecting web services from brute-force attacks, one effective method is using rate limiting. The limit_req_zone
directive in Nginx allows you to control how frequently a client can make requests, which helps prevent abuse like login attempts or API overuse.
What is limit_req_zone
and why it matters
Nginx’s limit_req_zone
sets up a shared memory zone that tracks request rates per key, usually based on IP address. If a client exceeds the allowed number of requests in a set time frame, Nginx will respond with an error (typically 503 Service Unavailable). This mechanism is crucial for slowing down or blocking brute-force attempts before they become a real threat.
For example, if someone tries to guess passwords by hitting your /login
endpoint hundreds of times, rate limiting can block them after a few failed attempts, without affecting normal users.
How to configure limit_req_zone
To use limit_req_zone
, you need to define a zone in your Nginx configuration. Here's a basic setup:
http { limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s; server { location /login { limit_req zone=one burst=5; proxy_pass http://backend; } } }
Let’s break this down:
$binary_remote_addr
means we’re tracking clients by their IP address.zone=one:10m
creates a shared memory zone named “one” with 10MB of space—enough to store about 160,000 IPv4 addresses.rate=1r/s
limits each client to one request per second.- In the location block,
burst=5
allows bursts of up to 5 requests before rate limiting kicks in.
This setup lets real users try a few logins quickly (like when they mistype a password), but blocks automated scripts trying hundreds of attempts.
Fine-tuning rate limits for better protection
You might want different rules for different endpoints. For example, /login
should be more strictly limited than a public homepage. You can create multiple zones:
limit_req_zone $binary_remote_addr zone=login_limit:10m rate=10r/m; limit_req_zone $binary_remote_addr zone=api_limit:10m rate=60r/m;
Here:
login_limit
allows only 10 requests per minute (about 1 every 6 seconds), which is very strict and good for login pages.api_limit
allows 60 requests per minute (1 per second), suitable for general API usage.
You can then apply these zones selectively:
location /login { limit_req zone=login_limit burst=3; } location /api { limit_req zone=api_limit burst=20; }
Also consider combining rate limiting with other protections like CAPTCHA or account lockouts after repeated failures. That way, even if someone bypasses rate limits slightly, there are still barriers in place.
And that’s basically how you implement rate limiting with limit_req_zone
to protect against brute-force attacks. It’s not overly complex, but it does require careful tuning based on your service’s needs.
The above is the detailed content of How to implement rate limiting to prevent brute-force attacks (limit_req_zone)?. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics











The browser prompts the "mixed content" warning because HTTP resources are referenced in the HTTPS page. The solution is: 1. Check the source of mixed content in the web page, view console information through the developer tool or use online tool detection; 2. Replace the resource link to HTTPS or relative paths, change http:// to https:// or use the //example.com/path/to/resource.js format; 3. Update the content in the CMS or database, replace the HTTP link in the article and page one by one, or replace it in batches with SQL statements; 4. Set the server to automatically rewrite the resource request, and add rules to the server configuration to force HTTPS to jump.

The main Nginx configuration file is usually located in the conf directory under /etc/nginx/nginx.conf (Ubuntu/Debian, CentOS/RHEL), /usr/local/etc/nginx/nginx.conf (macOSHomebrew) or the source code installation path; you can view the loaded configuration path through nginx-t, ps-ef|grepnginx check the path specified by the startup parameters, or use find/-namenginx.conf and locatenginx.conf to quickly find; the configuration file structure includes global settings, events blocks and http blocks, and common site configurations are common.

When Nginx experiences a "Toomyopenfiles" error, it is usually because the system or process has reached the file descriptor limit. Solutions include: 1. Increase the soft and hard limits of Linux system, set the relevant parameters of nginx or run users in /etc/security/limits.conf; 2. Adjust the worker_connections value of Nginx to adapt to expected traffic and ensure the overloaded configuration; 3. Increase the upper limit of system-level file descriptors fs.file-max, edit /etc/sysctl.conf and apply changes; 4. Optimize log and resource usage, and reduce unnecessary file handle usage, such as using open_l

The stub_status module displays the real-time basic status information of Nginx. Specifically, it includes: 1. The number of currently active connections; 2. The total number of accepted connections, the total number of processing connections, and the total number of requests; 3. The number of connections being read, written, and waiting. To check whether it is enabled, you can check whether the --with-http_stub_status_module parameter exists through the command nginx-V. If not enabled, recompile and add the module. When enabled, you need to add location blocks to the configuration file and set access control. Finally, reload the Nginx service to access the status page through the specified path. It is recommended to use it in combination with monitoring tools, but it is only available for internal network access and cannot replace a comprehensive monitoring solution.

Enabling Gzip compression can effectively reduce the size of web page files and improve loading speed. 1. The Apache server needs to add configuration in the .htaccess file and ensure that the mod_deflate module is enabled; 2.Nginx needs to edit the site configuration file, set gzipon and define the compression type, minimum length and compression level; 3. After the configuration is completed, you can verify whether it takes effect through online tools or browser developer tools. Pay attention to the server module status and MIME type integrity during operation to ensure normal compression operation.

To enable Nginx's HTTP/2 or HTTP/3 support, the prerequisites must be met and configured correctly; HTTP/2 requires Nginx1.9.5, OpenSSL1.0.2 and HTTPS environment; add --with-http_v2_module module during configuration, modify the listening statement to listen443sslhttp2; and overload the service; HTTP/3 is based on QUIC, and third-party modules such as nginx-quic are required to introduce BoringSSL or OpenSSLQUIC branches during compilation, and configure UDP listening ports; common problems during deployment include ALPN not enabled, certificate incompatible, firewall restrictions and compilation errors, it is recommended to use priority

To modify Nginx's running users and user groups, you need to complete the following steps in turn: 1. Edit nginx.conf file, add or modify user instructions, the format is userusernamegroupname; 2. Make sure that the specified user and user group already exist. If it does not exist, use the groupadd and useradd commands to create it; 3. Modify the permissions of the website directory and log directory to ensure that new users have access rights; 4. If you use the systemd startup method, you also need to check and modify the User and Group configuration items in the systemd unit file to maintain the same as in nginx.conf, and avoid overwriting of the configuration.

The "Addressalreadyinuse" error means that another program or service in the system has occupied the target port or IP address. Common reasons include: 1. The server is running repeatedly; 2. Other services occupy ports (such as Apache occupying port 80, causing Nginx to fail to start); 3. The port is not released after crash or restart. You can troubleshoot through the command line tool: use sudolsof-i:80 or sudolnetstat-tulpn|grep:80 in Linux/macOS; use netstat-ano|findstr:80 in Windows and check PID. Solutions include: 1. Stop the conflicting process (such as sudos
