iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The safest pattern is to let NGINX absorb request bursts before they reach Node.js. Define a shared limit_req_zone in the main http block, apply limit_req to the API location that proxies to Node, observe traffic with dry-run mode, then enforce a rate and burst that match your real clients.
What NGINX rate limiting does
NGINX can limit requests before they consume a Node.js connection, event-loop time, database work, or application memory. Its HTTP request-limit module uses a leaky-bucket method. The bucket is keyed by a variable, commonly $binary_remote_addr, and NGINX keeps per-key state in a shared memory zone.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A typical deployment is:
client → NGINX (TLS termination and rate limit) → Node.js (127.0.0.1:3000)The policy is independent of Node’s framework. It works with Express, Fastify, or another HTTP server because NGINX makes the decision before forwarding the request. This also means a rejected request never reaches your Node process, so expensive middleware, authentication checks, database queries, and application-level logging are avoided for that request.
Prerequisites and file locations on Ubuntu
- An Ubuntu server with administrative access.
- A Node.js application listening on a local address such as
127.0.0.1:3000. - A hostname that resolves to the server if you are using a named virtual host.
- Permission to edit NGINX configuration and reload the service.
Ubuntu’s NGINX installation guidance documents adding the official signing key and repository when needed, then installing the package with:
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
sudo apt update && sudo apt install nginxThe official NGINX repository is also where the latest NGINX Open Source version is published. Configuration files are under /etc/nginx/. The main file is /etc/nginx/nginx.conf; many installations include virtual-host files from a directory under that path. Access and error logs are under /var/log/nginx/. After installation, a simple local check is:
curl -I 127.0.0.1You should receive an HTTP response from NGINX. If your application is already configured behind NGINX, preserve the existing server and proxy settings and add the limit directives in the correct contexts rather than replacing the whole file.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the directives fit together
There are two required directives and several controls that change the behavior:
| Directive | Where it belongs | Purpose |
|---|---|---|
limit_req_zone |
Inside the main http {} block |
Creates shared memory for client state, selects the key, and sets the average request rate. |
limit_req |
Inside a server {} or location {} block |
Attaches a zone to a request path and sets its burst behavior. |
burst |
Parameter of limit_req |
Allows a queue of requests above the configured average rate. |
nodelay |
Parameter of limit_req |
Processes requests admitted by the burst immediately instead of spacing them out. |
limit_req_status |
http, server, or location |
Changes the rejection status. NGINX documents 503 as the default. |
limit_req_dry_run |
http, server, or location |
Accounts for excess requests without actually rejecting or delaying them. |
Rates use requests per second (r/s) or requests per minute (r/m). The memory-zone size is separate from the rate: a larger zone stores state for more keys, while the rate controls how quickly each key is allowed to proceed.
How the leaky bucket behaves
Think of the configured rate as the long-term drain speed for each key. Requests arriving at or below that speed pass normally. A short arrival spike fills the bucket up to the configured burst. If the burst is configured without nodelay, requests waiting in that allowance are released gradually at the configured rate, so the client may see added latency. With nodelay, requests that fit in the allowance are forwarded immediately; the burst still represents a finite amount of excess traffic, not a new sustained rate.
When the allowance is exhausted, additional requests are rejected. This distinction matters when choosing values: increasing burst helps absorb a short spike, while increasing the rate changes the long-term budget for every key. Neither setting guarantees a particular Node.js throughput figure.
A working NGINX configuration for a Node API
The following example limits requests by client IP, permits a short burst, returns the API-friendly status 429 when the burst is exhausted, and proxies accepted requests to Node.js.
# /etc/nginx/nginx.conf, inside the existing http { } block
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=5r/s;
server {
listen 80;
server_name example.com;
location /api/ {
limit_req zone=api_limit burst=10 nodelay;
limit_req_status 429;
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Replace example.com with the hostname in your virtual host and change the upstream address if Node listens elsewhere. Keep limit_req_zone in http {}; putting it inside a location causes a configuration error. Put limit_req beside the proxy_pass in the API location so the policy covers the traffic that would otherwise reach Node.
The values 5r/s, 10m, and burst=10 are illustrative starting values, not a universal capacity claim. NGINX’s documentation uses the zone size to store per-client state, and the correct values depend on your clients, endpoint cost, and normal traffic pattern.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Using one zone for several paths
A zone can be referenced by more than one location. That is useful when, for example, /api/login and /api/token should consume the same per-client budget. Conversely, define separate zones when different classes of traffic need independent limits, such as a strict policy for authentication and a more permissive policy for lightweight reads. The zone is declared once in http {}; each location then chooses which zone and burst policy to apply.
Recommended Free Tools
Choosing the key, rate, burst, and scope
Choose a trustworthy key
$binary_remote_addr creates a separate bucket for each address NGINX sees. It is compact and is the usual choice for a per-IP policy. A company, school, or mobile carrier may place many legitimate users behind one public address, so an IP limit can affect that group together. Conversely, a distributed attack can use many addresses and will not be stopped by one per-IP bucket alone.
Other keys are possible, such as a server name or another variable, but the variable must represent an identity you trust. Do not key the limit on an arbitrary client-supplied header unless your proxy topology guarantees that NGINX receives and validates it. If another load balancer sits in front of NGINX, verify which address NGINX actually sees before assuming the key represents an individual user.
Size the shared zone for the identities you expect
The 10m value in the example is the memory allocated to state for keys. It is not a 10 MB bandwidth allowance and it does not make the application accept ten megabytes of requests. A larger zone can retain state for more distinct client keys; the right size depends on how many addresses or other identities may be active at once. Keep the zone definition in the main configuration and avoid creating multiple zones accidentally for the same policy.
Set the average rate
The rate is the long-term allowance for each key. 5r/s means that one key is replenished at five requests per second; it does not mean exactly five requests can never arrive in one instant because the burst setting handles short arrivals. Use a lower rate for expensive endpoints such as login, search, or report generation, and a higher one for lightweight reads only after observing real traffic.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose r/m when a minute-level budget is easier to explain, or r/s when the endpoint is interactive and short-term timing matters. Do not compare a per-minute value with a per-second value without converting the units first.
Use burst for short spikes
burst=10 admits ten requests above the average allowance. Without nodelay, excess requests in that queue are delayed so they leave at the configured rate. With nodelay, requests that fit inside the burst are forwarded immediately, which keeps interactive APIs responsive but allows a brief surge to reach Node. Requests beyond the burst are rejected.
A burst is not additional sustained capacity. Once the queue is consumed, continued traffic remains limited by the average rate. If an endpoint cannot safely handle ten extra concurrent requests, choose a smaller burst or omit it. Delayed requests also occupy connections longer, so a policy without nodelay trades immediate rejection for queueing and latency.
Limit only the paths that need it
Applying the directive to location /api/ leaves static assets, a health endpoint, or an administrative path available for a separately designed policy. Applying it at the server level covers every location in that virtual host. A shared zone can be referenced by more than one location when those paths should consume the same per-client budget. Keep health checks out of a restrictive API location if monitoring must continue during client traffic spikes.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Choose the response status
NGINX documents HTTP 503 as the default response when a request is rejected. The example explicitly changes it to 429 (“Too Many Requests”), which many API clients interpret as a throttling response. Pick one deliberately and document it for clients; changing the status does not change the limiting algorithm. Test the actual status after reload rather than assuming an inherited setting is active.
Roll out the policy without an accidental outage
Apply the configuration in stages. Always validate before reloading.
- Edit the existing configuration. Add the zone to the main
http {}block and addlimit_reqto the intended API location. Do not create a secondhttpblock or duplicate a server definition for the same hostname. - Check syntax. Run
sudo nginx -tContinue only when NGINX reports that the test is successful.
- Reload safely. Use
sudo systemctl reload nginxA reload applies the validated configuration without requiring a full stop/start cycle.
- Begin in dry-run mode. Add
limit_req_dry_run on;in the same context as the policy, or in a broader context that covers the target location. Dry-run counts requests that would exceed the rate and burst but does not delay or reject them. - Observe normal traffic. Review
/var/log/nginx/access.logand/var/log/nginx/error.log, and compare application latency with the traffic pattern. Look for legitimate clients that would regularly exceed the proposed limit. - Generate a controlled test. Send repeated requests to the API path from one test address. Confirm that ordinary requests still reach Node and that dry-run mode leaves responses unchanged while recording excess activity.
- Enforce the policy. Change dry-run to
off(or remove the directive), runsudo nginx -tagain, reload, and repeat the same controlled test. - Revisit the values. Adjust rate, burst, scope, or key based on observed traffic rather than treating the illustrative numbers as a benchmark.
Keeping the dry-run phase separate from enforcement makes it possible to identify an overly strict policy before real clients receive throttling responses. Repeat the observation after changing an endpoint, adding a proxy hop, or changing authentication behavior; those changes can alter both traffic shape and the identity visible to NGINX.
Verify normal, burst, and rejected requests
Use a test endpoint that is safe to call repeatedly. This shell loop prints only status codes, making a short test easy to inspect:
for i in $(seq 1 30); do
curl -s -o /dev/null -w "%{http_code}n" http://example.com/api/health
doneRun it first while dry-run is enabled, then after enforcement. The exact sequence depends on timing, but the outcomes you are checking are:
- Requests below the configured allowance receive the normal application response.
- Requests admitted by
bursteither arrive immediately whennodelayis present or experience delay when it is absent. - Requests beyond the burst receive the configured rejection status, 429 in the example.
- Requests from a different client address use a different bucket when the key is
$binary_remote_addr.
For a more realistic check, run the same request pattern at the same time as ordinary browser or API-client traffic. A single sequential loop does not represent every concurrency pattern, and the official documentation does not provide a universal requests-per-second capacity number for all Node.js workloads. Test from the same network path your customers use when possible; testing directly on the server can exercise a different client address and therefore a different bucket.
Keep Express client identity consistent with NGINX
NGINX’s limit is based on the address visible to NGINX. Express may independently use req.ip, session rules, or an application-level limiter. Configure Express’s trust proxy setting to match the real proxy topology: the number and arrangement of proxies that you actually control.
// Example only: use a value that matches your deployment topology.
app.set('trust proxy', 1);The value 1 is appropriate only when the application is reached through one trusted proxy hop. A different topology may require another supported setting. Express uses this setting to determine how proxy-provided address and host information is exposed; trusting forwarded headers more broadly than your network warrants can let a client influence its apparent address. Make NGINX’s forwarded-header configuration and Express’s trust decision agree, and do not blindly trust arbitrary X-Forwarded-For values from the public internet.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsTroubleshoot common failures
nginx -t reports that limit_req_zone is not allowed here
Move the zone definition into the main http {} block in /etc/nginx/nginx.conf. The zone is declared once and referenced by name from a server or location.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Every request is rejected
Check that the rate is not accidentally expressed per minute when you intended per second, that the burst is large enough for the expected short spike, and that the key is not the same for all clients because of an incorrect proxy setup. Temporarily return to dry-run mode, inspect logs, and test from a known client address.
The response is 503 instead of 429
503 is NGINX’s documented default. Confirm that limit_req_status 429; is in the same or an inherited context as the active limit_req, then validate and reload.
Adding nodelay did not remove rejections
nodelay changes how requests inside the burst are served; it does not increase the burst size or permit sustained traffic above the configured rate. Requests after the burst is exhausted remain rejected.
Dry-run appears to do nothing
That is expected for client responses: dry-run records excess traffic without limiting processing. Confirm that the directive applies to the location receiving your test request, then inspect NGINX logs and application latency for evidence of traffic that would have been limited.
Node sees the proxy address instead of the client
Review the proxy_set_header directives and Express’s trust proxy setting together. The application should trust only the proxies in your actual path. Do not “fix” the symptom by trusting every forwarded address.
Static files or health checks are throttled unexpectedly
The limit is probably attached at the server level or a broad location. Move it to the API location, or create separate locations and policies for paths with different availability requirements.
Operational decisions to document
A maintainable policy records these choices so a later configuration change does not silently alter client behavior:
- Key: usually per client IP with
$binary_remote_addr, or another variable whose provenance is trusted. - Average rate: requests per second or minute for each key.
- Burst policy: delayed queue, immediate handling with
nodelay, or no burst. - Scope: one API location, an entire virtual host, or several locations sharing one zone.
- Client response: the default 503 or an explicitly selected 429.
- Rollout mode: dry-run observation followed by enforcement, rather than an unobserved immediate block.
NGINX’s directives define the mechanics, but no single rate is correct for every Node.js application. Recheck the settings after traffic, endpoint costs, authentication behavior, and proxy topology change. Teams that need commercial NGINX support or features for larger multi-instance deployments can evaluate NGINX Plus separately, but the Open Source directives shown here are sufficient for this per-client policy.
Frequently Asked Questions
Where should limit_req_zone go in an Ubuntu NGINX setup?
Put it once inside the main http {} block, usually in /etc/nginx/nginx.conf or a file included from that block. Apply the named zone later with limit_req in the relevant server or location block.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
What is the difference between burst and nodelay?
burst sets how many requests above the average rate may be admitted temporarily. Without nodelay, those requests wait in a queue and are released at the configured rate. With nodelay, requests inside the burst are forwarded immediately; requests beyond it are still rejected.
Why does NGINX return 503 instead of 429?
503 is the documented default rejection status. Add limit_req_status 429; in the active or inherited http, server, or location context, run sudo nginx -t, and reload NGINX.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Can I rate limit only my Node.js API and not static files?
Yes. Put limit_req in the API location, such as location /api/, beside proxy_pass. A policy at the server level covers every location, including static assets and health checks.
Does dry-run protect Node.js from a burst?
No. limit_req_dry_run on; records traffic that would exceed the policy but does not delay or reject it. Use it to observe logs and application latency before switching to enforcement.
Why do several users behind one office or carrier get throttled together?
With $binary_remote_addr, NGINX creates one bucket for the address it sees. Users sharing a public address therefore share that bucket. If your proxy topology changes the visible address, verify it before changing the key or trusting forwarded headers.
Should Express and NGINX use the same client IP settings?
They should reflect the same real proxy path. Configure Express trust proxy for the number and arrangement of proxies you control, and configure NGINX’s forwarded headers consistently. Never trust arbitrary public X-Forwarded-For values.
Is 5 requests per second a recommended limit for every Node app?
No. The example’s 5r/s, 10 MB zone, and burst=10 are starting values only. Choose limits from observed client behavior, endpoint cost, and acceptable latency; NGINX publishes directive semantics, not a universal Node.js capacity benchmark.
The Bottom Line
Define the shared zone in http {}, attach it only to the Node API paths that need protection, and choose the key, rate, burst, and rejection status deliberately. Validate with nginx -t, observe with dry-run mode, test normal and burst traffic, then enforce and keep Express’s proxy trust aligned with the real network path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
