Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this simple Nginx configuration:

server { 
    listen 80;
    rewrite ^(.*)$1 permanent;

server {
    listen   80;
    access_log /var/log/nginx/;
    error_log /var/log/nginx/;

     root   /var/www/;

    location / {        
        index index.html index.php;

    location ~ \.php$ {        
        include /etc/nginx/fastcgi_params;
        fastcgi_index index.php;
        fastcgi_param  SCRIPT_FILENAME  /var/www/$fastcgi_script_name;

it is the time to prevent flooding(dos) attacks. I would like to implement those two rules:

1) I would block more then 3 requests per second for PHP requests.

example: (blocks it stop if it is within the second)

2) I would block more then 3 request per second for the same resource (blocks it stop if it is within the second)

My goal is to completly blocks the requests, I say that because i saw nodelay param returns 503 to attackers. In this case if the limit is reached I surelly know that it's an attack, so I want to block the response. With "block" I mean that I do not want to send 503 message, I want that NGINX drops the connections without sending nothing.

How can I optimize this configuration to implement these rules?

Thank you.

share|improve this question

nginx has the HttpLimitReqModule module available. You can define different zones and allowed access patterns. If a user exceeds the allowed number of accesses, 503 is returned.

share|improve this answer
as I told above, I do not want to send a message back, I want to drop the connection because it is surelly an attacker. Could you give me an example? – Dail Sep 3 '12 at 7:09
Apparently nginx can use a special HTTP header as an response where it will silently drop the connection. See this stackoverflow post – j0nes Sep 3 '12 at 7:37
thank you... but in that example there is a location like /something. Here I need to return 444 if the limit req is reached, does this module accept any other parament to sent a "location"? if it is possible i can put 444 there. – Dail Sep 3 '12 at 8:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.