How Accurate is Rate Limiting?

Hi @dimalifragis, thanks for your question

If the server allows many connections in parallel from the same IP, then visits being counted can overlap. If the rate limit is 1 away from being reached, but the server has started processing 4 new hits, it’s possible that each of those 4 will see 14 are counted so far, and be allowed, then increment the counter.

The alternative to handling it this way would be to make?every hit?apply a lock of some sort to ensure no other hits to the site hadn’t been counted yet. This could make the site slower for legitimate users, or allow a single bot to tie up all of the web server’s workers, preventing other legitimate users from visiting the site.

The point of rate limiting in the plugin is to decrease excess resource usage by individual IPs, by blocking or throttling an IP once it hits the limit that is considered to be abusive by the site owner, but without affecting normal users.

If the site needs to have more strict rate limiting, it is best done in the web server, or firewall like iptables. Some details:

• Apache:?https://stackoverflow.com/questions/131681/how-can-i-implement-rate-limiting-with-apache-requests-per-second
• NGINX:?https://nginx.org/en/docs/http/ngx_http_limit_req_module.html
• The?--limit?option in iptables:?https://linux.die.net/man/8/iptables

Thanks,
Peter.

Thanks, i get that. Not an exact science ??

Appreciated the details.

btw: 404 rate limit with block is also an excellent way to block attacking probes (php, directories, etc). If of cource the site has no 404 issues….

• This reply was modified 9 months, 2 weeks ago by dimal.