I have set up nginx as a reverse proxy for my webapp. I have configured nginx to rate-limit login requests to 10/minute with a burst up to 20:

limit_req_zone $remote_addr zone=login:10m rate=10r/m;
limit_req_status 429;

server {
  location /login {
    limit_req zone=login burst=20 nodelay;


This rate-limiting works well with one caveat. If people are trying to automate trying different passwords at a higher rate than allowed, they will be rate limited, but nginx will still allow 10 requests/minute.

I want to configure the rate limiting so that nginx includes blocked requests in the rate limit. This means that if someone keeps trying to log in then they won't get any attempts granted until they slow down.

I've heard this described as 'strict' rate-limiting.

Strict mode

One extension we’ve made is the concept of strict rate limits. Often when a rate limit is triggered, we’ll want to continue blocking traffic until the user stops sending traffic.

Is it possible to do this in nginx?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.