The panel can limit how many requests a single IP address may make to your site. This helps against crude flooding and aggressive crawlers, and is configured per website.
Be clear about what this does and does not do. It is a request limit at web server level: it helps when one or a few addresses send too many requests. It will not stop a real distributed attack from thousands of addresses, because the traffic still reaches your server. For that, protection has to filter the traffic before it arrives — if you are under a serious attack, open a ticket rather than adjusting these settings.
Requirements
Your site must be served by Nginx or OpenLiteSpeed. The two behave differently: Nginx blocks the offending address outright, while OpenLiteSpeed limits its bandwidth.
Enabling protection
- Go to Sites and open the site for editing.
- Open Optimization and DDoS protection.
- Tick Enable DDoS protection and set the parameters.
Parameters for Nginx
- Requests per second (rate) — how many requests per second from one IP address are processed normally.
- Maximum peak attack size (burst) — how many additional requests from that address may be queued before it is blocked.
An address that exceeds the limits receives error 429 (Too Many Requests) and is then blocked at firewall level for five minutes by default.
Parameters for OpenLiteSpeed
- Requests per second — requests above this number are rejected until the next second.
- Bandwidth, byte/sec — the bandwidth limit per address. A value of 0 disables the limit.
Choosing sensible values
Set the limits too low and you will block your own visitors. A single page view typically causes several requests, and browsers issue them together — so a limit of a few requests per second with no burst allowance will break normal browsing.
Start generously, watch the result, and tighten gradually. Bear in mind who else talks to your site: search engine crawlers, monitoring services, payment provider callbacks and your own API clients can all be blocked by limits that are too aggressive.
Also remember that visitors behind a corporate network or a mobile operator share one address, so what looks like a flood from a single IP may be a dozen ordinary users.
If legitimate visitors are being blocked
Raise the rate and burst values, or turn the protection off temporarily to confirm that it is the cause. On Nginx, blocks expire by themselves after a few minutes, so a wrongly blocked visitor is not locked out permanently.
If you are not sure what limits suit your site, or you think an attack is under way, open a ticket from your client area — we can see the traffic reaching the server and advise from that.
