Nginx Rate Limiting and Security Best Practices

1. Threat model

Identify abusive patterns: brute-force, scraping, or abusive API clients.

2. Basic rate limiting with limit_req

http {
  limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;
}
server {
  location /api/ {
    limit_req zone=one burst=10 nodelay;
  }
}

3. IP blocking and geofencing

Use ACLs and deny rules for known bad IP ranges; prefer fail2ban for adaptive blocking.

4. TLS configuration

server {
  listen 443 ssl http2;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:...';
  ssl_prefer_server_ciphers on;
}

5. Security headers

add_header X-Frame-Options "DENY";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "no-referrer-when-downgrade";

6. Request validation and body limits

Limit request body sizes, timeouts and max header sizes to reduce resource exhaustion.

7. Monitoring and alerting

Expose metrics for rate limiter, log suspicious requests and alert on spikes.