{"id":1178,"date":"2026-09-19T22:01:58","date_gmt":"2026-09-19T22:01:58","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/"},"modified":"2026-09-19T22:01:58","modified_gmt":"2026-09-19T22:01:58","slug":"nginx-rate-limiting-limit-req-vps-protection","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/","title":{"rendered":"Nginx Rate Limiting with limit_req: Protecting a Small VPS Without Blocking Real Users"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A single PHP endpoint hit 300 times per second will exhaust a 1 vCPU VPS in under a minute. The usual reflex is to install a firewall rule or a Cloudflare filter, but nginx already ships with a token-bucket rate limiter that runs in the connection-handling hot path with almost no overhead. This tutorial configures <code>limit_req_zone<\/code>, <code>limit_req<\/code>, and <code>limit_conn<\/code> correctly on a 2026-era VPS, then verifies the behaviour with real traffic instead of trusting the config.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What the Token Bucket Actually Does<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">nginx measures requests per second per key. The key is usually <code>$binary_remote_addr<\/code> (a 4-byte IPv4 or 16-byte IPv6 representation, far cheaper than a string). Two numbers control behaviour:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>rate<\/strong> &mdash; the sustained refill rate, e.g. <code>10r\/s<\/code>.<\/li>\n<li><strong>burst<\/strong> &mdash; how many requests may queue above the rate before nginx returns 503.<\/li>\n<li><strong>nodelay<\/strong> &mdash; serves the burst immediately instead of spreading it out at the configured rate.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Without <code>nodelay<\/code>, a browser loading 20 assets at once will be artificially slowed even though the client is legitimate. That is the single most common misconfiguration we see on self-managed boxes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Declare the Zones in the http Block<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Zones must live in the <code>http<\/code> context, because the shared memory segment is allocated once at worker start and then shared by every worker process. On a 2 GB VPS the memory cost is trivial: 10 MB of shared memory holds roughly 160,000 tracked IP states.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># \/etc\/nginx\/nginx.conf\nhttp {\n    # general API\/HTML requests\n    limit_req_zone $binary_remote_addr zone=general:10m rate=20r\/s;\n\n    # login, search, password-reset: cheap to abuse, expensive to serve\n    limit_req_zone $binary_remote_addr zone=strict:10m rate=3r\/s;\n\n    # concurrent connections per IP\n    limit_conn_zone $binary_remote_addr zone=perip:10m;\n\n    limit_req_status 429;\n    limit_conn_status 429;\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Returning <strong>429 Too Many Requests<\/strong> rather than 503 is deliberate. 503 signals a broken upstream and pollutes your error-rate alerts; 429 tells the client to back off and is understood by search crawlers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Apply the Limits Per Location<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>server {\n    server_name example.com;\n\n    location \/ {\n        limit_req zone=general burst=40 nodelay;\n        limit_conn perip 25;\n        try_files $uri $uri\/ \/index.php?$args;\n    }\n\n    location = \/wp-login.php {\n        limit_req zone=strict burst=5 nodelay;\n        include fastcgi_params;\n        fastcgi_pass unix:\/run\/php\/php8.4-fpm.sock;\n    }\n\n    location ~* \/(xmlrpc\\.php|wp-cron\\.php) {\n        limit_req zone=strict burst=2 nodelay;\n        deny all;\n    }\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Two details matter here. First, <code>limit_req<\/code> is inherited by nested locations, so if you set it at <code>server<\/code> level and then add a stricter one inside a location, both apply &mdash; the stricter effective rate wins. Second, static assets served by <code>try_files<\/code> and a separate <code>location ~* \\.(css|js|png)$<\/code> block should normally carry <em>no<\/em> rate limit at all, or a CDN edge will be throttled while fetching them.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Whitelist Your Own Monitors<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Uptime checks and your CI smoke tests will trip the limiter and generate false alarms. Carve out a map so trusted sources bypass the zones entirely:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>geo $limit_key {\n    default        $binary_remote_addr;\n    203.0.113.7\/32 \"\";\n    198.51.100.0\/24 \"\";\n}\n\n# then use the map as the zone key\nlimit_req_zone $limit_key zone=general:10m rate=20r\/s;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">An empty key is never limited by nginx &mdash; the request is simply skipped. Note that the <code>geo<\/code> module returns the raw value, so only the standard <code>limit_req_zone<\/code> with a variable key is required.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Verify With Real Traffic<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Never assume the config works. Reload and hit a limited endpoint 60 times from one IP:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nginx -t && sudo systemctl reload nginx\n\nfor i in $(seq 1 60); do\n  curl -s -o \/dev\/null -w '%{http_code} ' https:\/\/example.com\/api\/search\ndone; echo<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A correctly configured <code>3r\/s burst=5 nodelay<\/code> zone returns a short run of <code>200<\/code> followed by a wall of <code>429<\/code>. If you see all 200s, your key variable is empty (likely because a <code>geo<\/code> or <code>map<\/code> block failed to load). If you see 503, you left <code>limit_req_status<\/code> at its default.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cross-check the limiter against the kernel-level picture while the load test runs, using the same method described in <a href=\"https:\/\/virtualserversvps.com\/blog\/load-average-vs-cpu-saturation-vps-monitoring\">reading load average against real CPU saturation<\/a> &mdash; a limiter that drops requests should visibly reduce CPU pressure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Choosing Sensible Numbers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Endpoint type<\/th><th>rate<\/th><th>burst<\/th><th>Rationale<\/th><\/tr><\/thead><tbody><tr><td>Static assets (no limit)<\/td><td>&mdash;<\/td><td>&mdash;<\/td><td>Browsers fan out 6&ndash;8 parallel requests<\/td><\/tr><tr><td>HTML \/ GET pages<\/td><td>20r\/s<\/td><td>40 nodelay<\/td><td>Handles prefetch and back-button bursts<\/td><\/tr><tr><td>Search \/ filtering<\/td><td>5r\/s<\/td><td>10 nodelay<\/td><td>Index scans are the expensive path<\/td><\/tr><tr><td>Login \/ password reset<\/td><td>3r\/s<\/td><td>5 nodelay<\/td><td>Blocks credential stuffing without lockouts for real users<\/td><\/tr><tr><td>Concurrent conns per IP<\/td><td>&mdash;<\/td><td>25<\/td><td>Stops slow-loris style connection hoarding<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">What Rate Limiting Cannot Fix<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If every request is coming from a distinct IP &mdash; a botnet or a distributed scraper &mdash; per-IP token buckets do nothing. At that point you need a shared key (an API token, a cookie, a session ID) or an edge filter. Similarly, <code>limit_req<\/code> protects the request rate, not the payload size; a single 500 MB <code>POST<\/code> upload is governed by <code>client_max_body_size<\/code> and <code>client_body_timeout<\/code> instead.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Building a layered defence &mdash; nginx limiter, a correctly sized PHP-FPM pool, and a database that is not the bottleneck &mdash; is what separates a stable 1 vCPU instance from one that falls over every time a post reaches the front page. If you are choosing the underlying instance for that workload, the sizing trade-offs are laid out in our <a href=\"https:\/\/virtualserversvps.com\/\">VPS platform and configuration overview<\/a>, and the pool arithmetic is covered in <a href=\"https:\/\/virtualserversvps.com\/blog\/tuning-php-fpm-process-pools-by-workload\">tuning PHP-FPM pools by workload type<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Checklist<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Zones declared in <code>http<\/code>, sized 10 MB each.<\/li>\n<li><code>nodelay<\/code> on every burst you do not want artificially slowed.<\/li>\n<li>429 status, not 503, so monitoring stays honest.<\/li>\n<li>Stricter zones on login, search, and XML-RPC.<\/li>\n<li>Monitors and CI whitelisted via <code>geo<\/code>.<\/li>\n<li>Verified with a 60-request loop, not by eye.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A single PHP endpoint hit 300 times per second will exhaust a 1 vCPU VPS in under a minute. The usual reflex is to install a firewall rule or a&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1178","post","type-post","status-publish","format-standard","hentry","category-vps-guides-tutorials"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Nginx Rate Limiting with limit_req: Protecting a Small VPS Without Blocking Real Users - Virtual Servers VPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Nginx Rate Limiting with limit_req: Protecting a Small VPS Without Blocking Real Users\" \/>\n<meta property=\"og:description\" content=\"Nginx Rate Limiting with limit_req: Protecting a Small VPS Without Blocking Real Users\" \/>\n<meta property=\"og:url\" content=\"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/\" \/>\n<meta property=\"og:site_name\" content=\"Virtual Servers VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-19T22:01:58+00:00\" \/>\n<meta name=\"author\" content=\"Virtual-Servers-Vps-Editor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Virtual-Servers-Vps-Editor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/\",\"name\":\"Nginx Rate Limiting with limit_req: Protecting a Small VPS Without Blocking Real Users - Virtual Servers VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\"},\"datePublished\":\"2026-09-19T22:01:58+00:00\",\"author\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\"},\"breadcrumb\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/virtualserversvps.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Nginx Rate Limiting with limit_req: Protecting a Small VPS Without Blocking Real Users\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/\",\"name\":\"Virtual Servers VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\",\"name\":\"Virtual-Servers-Vps-Editor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"caption\":\"Virtual-Servers-Vps-Editor\"},\"sameAs\":[\"https:\/\/virtualserversvps.com\/blog\"],\"url\":\"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Nginx Rate Limiting with limit_req: Protecting a Small VPS Without Blocking Real Users - Virtual Servers VPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/","og_locale":"en_US","og_type":"article","og_title":"Nginx Rate Limiting with limit_req: Protecting a Small VPS Without Blocking Real Users","og_description":"Nginx Rate Limiting with limit_req: Protecting a Small VPS Without Blocking Real Users","og_url":"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/","og_site_name":"Virtual Servers VPS Blog","article_published_time":"2026-09-19T22:01:58+00:00","author":"Virtual-Servers-Vps-Editor","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Virtual-Servers-Vps-Editor","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/","url":"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/","name":"Nginx Rate Limiting with limit_req: Protecting a Small VPS Without Blocking Real Users - Virtual Servers VPS Blog","isPartOf":{"@id":"https:\/\/virtualserversvps.com\/blog\/#website"},"datePublished":"2026-09-19T22:01:58+00:00","author":{"@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0"},"breadcrumb":{"@id":"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/virtualserversvps.com\/blog\/nginx-rate-limiting-limit-req-vps-protection\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/virtualserversvps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Nginx Rate Limiting with limit_req: Protecting a Small VPS Without Blocking Real Users"}]},{"@type":"WebSite","@id":"https:\/\/virtualserversvps.com\/blog\/#website","url":"https:\/\/virtualserversvps.com\/blog\/","name":"Virtual Servers VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0","name":"Virtual-Servers-Vps-Editor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","caption":"Virtual-Servers-Vps-Editor"},"sameAs":["https:\/\/virtualserversvps.com\/blog"],"url":"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/"}]}},"_links":{"self":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/1178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/comments?post=1178"}],"version-history":[{"count":0,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/1178\/revisions"}],"wp:attachment":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/media?parent=1178"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/categories?post=1178"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/tags?post=1178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}