[GH-ISSUE #116] [Feature Request] Support for rate limiting

kerem commented

2026-02-26 05:34:35 +03:00

Owner

Originally created by @nfacha on GitHub (Apr 6, 2019).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/116

Allow to configure NGINX rate limits from the UI

Originally created by @nfacha on GitHub (Apr 6, 2019). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/116 Allow to configure NGINX rate limits from the UI

kerem added the

enhancement

label

2026-02-26 05:34:35 +03:00

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@thefirst100yearsaredifficult commented on GitHub (Oct 31, 2020):

Any updates on this? @jc21

@thefirst100yearsaredifficult commented on GitHub (Oct 31, 2020): Any updates on this? @jc21

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@dedarh commented on GitHub (Mar 1, 2021):

Any updates on this? @jc21

@dedarh commented on GitHub (Mar 1, 2021): Any updates on this? @jc21

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@JackBailey commented on GitHub (Jan 26, 2022):

Any updates on this? @jc21

@JackBailey commented on GitHub (Jan 26, 2022): Any updates on this? @jc21

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@ArmJo commented on GitHub (Feb 24, 2022):

For everyone who wants to implement it partially without UI: you can use the option for advanced configuration.

Create the file /data/nginx/custom/http_top.conf (maybe mounted elsewhere so check your docker volumes)
Edit the file and insert the line limit_req_zone $binary_remote_addr zone=mylimit:10m rate=3r/s; (can be changed to your needs and multiple zones are possible). Save and close the file
Restart NPM and open the Web UI
Edit the Proxy Host and under advanced you can add this code (example for Jellyfin):

location /Users/authenticatebyname {
   limit_req zone=mylimit burst=8 delay=6;
   proxy_pass http://$server:$port;
}

Edit the location, burst and delay (maybe change the scheme to https if needed)
Save the changes, it should still show "online"

More information about the configuration on the offical nginx page

I use this setup for Jellyfin and filebrowser and it works fine for me.

@ArmJo commented on GitHub (Feb 24, 2022): For everyone who wants to implement it partially without UI: you can use the option for [advanced configuration](https://nginxproxymanager.com/advanced-config/#custom-nginx-configurations). 1. Create the file `/data/nginx/custom/http_top.conf` (maybe mounted elsewhere so check your docker volumes) 2. Edit the file and insert the line `limit_req_zone $binary_remote_addr zone=mylimit:10m rate=3r/s;` (can be changed to your needs and multiple zones are possible). Save and close the file 3. Restart NPM and open the Web UI 4. Edit the Proxy Host and under `advanced` you can add this code (example for Jellyfin): ``` location /Users/authenticatebyname { limit_req zone=mylimit burst=8 delay=6; proxy_pass http://$server:$port; } ``` 5. Edit the location, burst and delay (maybe change the scheme to https if needed) 6. Save the changes, it should still show "online" More information about the configuration on the [offical nginx page](https://www.nginx.com/blog/rate-limiting-nginx/) I use this setup for Jellyfin and filebrowser and it works fine for me.

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@cardtap commented on GitHub (Oct 20, 2022):

Just wanted to add that this feature would be very helpful for me as well. The custom http_top config works wonders but having the custom location in the advanced section isn't the cleanest approach. Even if there was a one line field that would allow you to insert the limit_req parameters in the existing location directive, that would be sweet.

@cardtap commented on GitHub (Oct 20, 2022): Just wanted to add that this feature would be very helpful for me as well. The custom http_top config works wonders but having the custom location in the advanced section isn't the cleanest approach. Even if there was a one line field that would allow you to insert the limit_req parameters in the existing location directive, that would be sweet.

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@geez0r commented on GitHub (Jan 5, 2023):

hello,
another "yes please me too" comment...

After having a look at the network traffic and being horrified I would also suggest having this as a priority. The whole point of NPM is to take away the pain of manually messing with nginx config and a built in rate limit / fail2ban functionality would be very welcome.

Cheers

@geez0r commented on GitHub (Jan 5, 2023): hello, another "yes please me too" comment... After having a look at the network traffic and being horrified I would also suggest having this as a priority. The whole point of NPM is to take away the pain of manually messing with nginx config and a built in rate limit / fail2ban functionality would be very welcome. Cheers

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@Robin-Sch commented on GitHub (Jun 16, 2023):

location /Users/authenticatebyname {
   limit_req zone=mylimit burst=8 delay=6;
   proxy_pass http://$server:$port;
}

This is not working for my nextcloud instance (it gave the untrusted domain error), however, this does work:

location /Users/authenticatebyname {
    limit_req zone=mylimit burst=8 delay=6;
    include conf.d/include/proxy.conf;
}

@Robin-Sch commented on GitHub (Jun 16, 2023): > ``` > location /Users/authenticatebyname { > limit_req zone=mylimit burst=8 delay=6; > proxy_pass http://$server:$port; > } > ``` This is not working for my nextcloud instance (it gave the untrusted domain error), however, this does work: ``` location /Users/authenticatebyname { limit_req zone=mylimit burst=8 delay=6; include conf.d/include/proxy.conf; } ```

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@TornadoRadon commented on GitHub (Nov 14, 2023):

I wonder why this issue still open

@TornadoRadon commented on GitHub (Nov 14, 2023): I wonder why this issue still open

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@unitea1992 commented on GitHub (Jan 28, 2024):

Do you have any plans to address this issue?
I am strongly requesting this feature.

@unitea1992 commented on GitHub (Jan 28, 2024): Do you have any plans to address this issue? I am strongly requesting this feature.

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@AlexPewMaster commented on GitHub (Apr 9, 2024):

Hi, I personally use Nginx Proxy Manager to publicly host services. I would really appreciate it if this could get implemented to prevent DDoS attacks and possibly filling up all of the available traffic.

@AlexPewMaster commented on GitHub (Apr 9, 2024): Hi, I personally use Nginx Proxy Manager to publicly host services. I would really appreciate it if this could get implemented to prevent DDoS attacks and possibly filling up all of the available traffic.

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@aminnairi commented on GitHub (Jul 11, 2024):

Any plans on supporting this in a near future? 👀

@aminnairi commented on GitHub (Jul 11, 2024): Any plans on supporting this in a near future? :eyes:

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@NazgulCoder commented on GitHub (Aug 22, 2024):

location /Users/authenticatebyname {
   limit_req zone=mylimit burst=8 delay=6;
   proxy_pass http://$server:$port;
}
This is not working for my nextcloud instance (it gave the untrusted domain error), however, this does work:
location /Users/authenticatebyname {
    limit_req zone=mylimit burst=8 delay=6;
    include conf.d/include/proxy.conf;
}

I did it like this and it works

location /Users/authenticatebyname {
   limit_req zone=mylimit burst=8 delay=6;
   proxy_pass http://$server:$port;
}

but how can I do it for the entire website?

using

location / {

will not work. When i try to open any /subpage it will try to pass the connection to the private IP of the docker container

Also, do you know how to implement it correctly with Cloudflare so that it does not rate limit the Cloudflare IPs, but instead it checks the REAL IPs?

@NazgulCoder commented on GitHub (Aug 22, 2024): > > ``` > > location /Users/authenticatebyname { > > limit_req zone=mylimit burst=8 delay=6; > > proxy_pass http://$server:$port; > > } > > ``` > > This is not working for my nextcloud instance (it gave the untrusted domain error), however, this does work: > > ``` > location /Users/authenticatebyname { > limit_req zone=mylimit burst=8 delay=6; > include conf.d/include/proxy.conf; > } > ``` I did it like this and it works ``` location /Users/authenticatebyname { limit_req zone=mylimit burst=8 delay=6; proxy_pass http://$server:$port; } ``` but how can I do it for the entire website? using `location / {` will not work. When i try to open any /subpage it will try to pass the connection to the private IP of the docker container Also, do you know how to implement it correctly with Cloudflare so that it does not rate limit the Cloudflare IPs, but instead it checks the REAL IPs?

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@presotto-m commented on GitHub (Feb 7, 2025):

Any updates on this? I'm in need of a rate limit setting.

@presotto-m commented on GitHub (Feb 7, 2025): Any updates on this? I'm in need of a rate limit setting.

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@mourraille commented on GitHub (Apr 7, 2025):

Any plans to add rate limit support ?

@mourraille commented on GitHub (Apr 7, 2025): Any plans to add rate limit support ?

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@0xc0000f commented on GitHub (May 15, 2025):

any updates ?

@0xc0000f commented on GitHub (May 15, 2025): any updates ?

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Dec 9, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Dec 9, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@amarotica commented on GitHub (Dec 9, 2025):

Just bumping this - rate limiting is not stale. Any ideas on how to implement? Thanks

@amarotica commented on GitHub (Dec 9, 2025): Just bumping this - rate limiting is not stale. Any ideas on how to implement? Thanks

kerem commented

2026-02-26 05:34:36 +03:00

Author

Owner

@enriluis commented on GitHub (Feb 11, 2026):

still open?

@enriluis commented on GitHub (Feb 11, 2026): still open?

Rows
Columns

[GH-ISSUE #116] [Feature Request] Support for rate limiting #103