I have this simple Nginx configuration:

server { 
    listen 80;
    server_name example.com;
    rewrite ^(.*) http://www.example.com$1 permanent;

server {
    listen   80;
    server_name www.example.com;
    access_log /var/log/nginx/www.example.com.access.log;
    error_log /var/log/nginx/www.example.com.error.log;

     root   /var/www/example.com/;

    location / {        
        index index.html index.php;

    location ~ \.php$ {        
        include /etc/nginx/fastcgi_params;
        fastcgi_index index.php;
        fastcgi_param  SCRIPT_FILENAME  /var/www/example.com/$fastcgi_script_name;

it is the time to prevent flooding(dos) attacks. I would like to implement those two rules:

1) I would block more then 3 requests per second for PHP requests.


www.example.com/page.php (blocks it stop if it is within the second)

2) I would block more then 3 request per second for the same resource

www.example.com/img.jpg (blocks it stop if it is within the second)

My goal is to completly blocks the requests, I say that because i saw nodelay param returns 503 to attackers. In this case if the limit is reached I surelly know that it's an attack, so I want to block the response. With "block" I mean that I do not want to send 503 message, I want that NGINX drops the connections without sending nothing.

How can I optimize this configuration to implement these rules?

Thank you.


nginx has the HttpLimitReqModule module available. You can define different zones and allowed access patterns. If a user exceeds the allowed number of accesses, 503 is returned.

  • as I told above, I do not want to send a message back, I want to drop the connection because it is surelly an attacker. Could you give me an example? – Dail Sep 3 '12 at 7:09
  • Apparently nginx can use a special HTTP header as an response where it will silently drop the connection. See this stackoverflow post – j0nes Sep 3 '12 at 7:37
  • thank you... but in that example there is a location like /something. Here I need to return 444 if the limit req is reached, does this module accept any other parament to sent a "location"? if it is possible i can put 444 there. – Dail Sep 3 '12 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.