Rate Limiting

Rate limiting caps requests from one visitor in a time window; go over it and nsin blocks or challenges them.

Use cases:

• Protect login/sign-up from credential stuffing.
• Stop catalogue scraping.
• Protect an expensive endpoint (search, export, API).
• Take the edge off traffic spikes.

Create a rate limit rule

1. Rules → Add Rule → Rate Limit.
2. Set the protected address — e.g. /login.
3. Optionally pick the HTTP methods to count — e.g. only POST.
4. Set requests-per-seconds, counting mode, and breach action.
5. Save.

HTTP methods

Leave HTTP methods empty to count every request. Pick one or more (GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS) to count only those — a login form is a POST, so limiting POST leaves page views alone. A request with another method skips the rule and is checked against your next rate limit rule.

Counting modes

Counting	What it means
Per visitor	Everything from one address counts together.
Per visitor, per address	Each path is counted separately.

Per visitor limits total activity; per address stops one endpoint draining another’s budget.

Breach actions

• Block — refuses requests until the window passes. For abuse.
• Challenge — visitor proves they’re human, then continues. For limits a real person might hit.

Burst: a few extra requests tolerated momentarily, so a page firing several at once doesn’t trip it.

Example

Protect login: /login, POST only, 5 requests per 60 seconds, per visitor, challenge on breach.

Real people log in once or twice; a password-guessing script hits the wall immediately.

Picking a limit

• Start higher than normal use, then tighten once you’ve seen traffic.
• A page view is many requests (images, CSS, API) — scope to the endpoint.
• One office or mobile network shares an address — site-wide limits catch them together.

Common questions

Will this block real visitors? Not with a sensible, scoped limit. If unsure, use challenge.

Hit the limit by accident? It clears itself once the window passes.

Rate limiting or the WAF? Both. WAF stops attacks; rate limiting controls how often anyone knocks. For traffic you never want, use a block rule.

Blocked visitors see nsin’s page. That’s nsin’s own 429 page, not replaceable — error page rules only cover 5xx. See Custom Error Pages.