---
title: "Working with HTTP rate-limiting"
date: "2017-09-12"
category: "web-content"
slug: "working-with-http-rate-limiting"
---

## Overview

All HTTP servers enforce rate-limiting to reduce abuse and maintain reliability. This system is built on a fork of [mod\_evasive](https://github.com/apisnetworks/mod_evasive), which uses interval-based request counting -- it starts tracking URI requests for a set duration once the first request is received.

There are two classes of rate limits: **pages in total** and **same page** requests. Exceeding either threshold triggers an automatic 10-minute ban. Three bans within 24 hours result in an automatic 7-day ban on HTTP ports 80 and 443.

Blocked clients receive a **403 Forbidden** response.

## Pages in Total

This limit tracks all URL requests from a single IP address within a rolling window. If the threshold is exceeded, the IP is automatically blocked.

If your pages are image-heavy (verify with [webpagetest.org](https://webpagetest.org)), consider reducing HTTP requests by consolidating images into [CSS sprites](https://css-tricks.com/css-sprites/) or [inlining small assets as base64](https://stackoverflow.com/questions/1574961/how-much-faster-is-it-to-use-inline-base64-images-for-a-web-site-than-just-linki).

## Same Page Requests

This is a stricter limit that tracks repeated requests to the same URI, designed to filter brute-force attacks.

If your application polls a page repeatedly (e.g. autocomplete on a [keydown event](https://developer.mozilla.org/en-US/docs/Web/Events/keydown)), add a debounce delay using [setTimeout](https://www.w3schools.com/jsref/met_win_settimeout.asp) so requests are only sent after a brief pause in typing:

```javascript
$("#input").on('keydown', function() {
    var timer;
    timer = setTimeout(function() {
        cancelTimeout(timer);
        // cancel other async events
        // do autocomplete AJAX callback
    }, 250 /** 250 milliseconds */);
});
```

This assumes a typing speed of at least 4 characters per second (~48 WPM). Without a debounce delay, triggering the same-page limit would require typing at approximately 96 WPM with AJAX callbacks on every keystroke -- feasible but unlikely.

## Thresholds

| Limit Type | Threshold |
|------------|-----------|
| Same page | 4 requests in 1 second |
| Pages in total | 150 requests in 3 seconds |

Three blocks within 24 hours escalate to a 7-day ban. Once a ban is in effect, the only resolution is to open a support ticket to have it removed.
