How to Prevent DDoS Attacks with Nginx

Introduction

Distributed Denial of Service (DDoS) attacks are among the most common cyber threats that web servers face today. A DDoS attack floods your server with illegitimate traffic, making it unavailable to legitimate users. Since Nginx is one of the most popular web servers and reverse proxies in the world, it provides powerful configuration options to mitigate DDoS attempts. For cPanel users, the Cpnginx plugin simplifies this process by offering built-in firewall settings and rate-limiting modules directly from WHM.

In this guide, we’ll explore how to prevent DDoS attacks with Nginx and Cpnginx, covering everything from basic configurations to advanced attack mitigations.

What is a Layer 7 DDoS Attack?

A Layer 7 DDoS attack targets the application layer of the OSI model, where HTTP requests are processed. Unlike lower-layer attacks that flood bandwidth or network connections, Layer 7 attacks simulate real user behavior, making them harder to detect. Examples include HTTP floods, Slowloris attacks, and malicious bot traffic.

Because these attacks exploit legitimate HTTP/S requests, a specialized server like Nginx, with fine-grained request controls, is essential for protection.

Why Use Nginx to Prevent DDoS Attacks?

Nginx is widely used by high-traffic websites, CDNs, and hosting providers because of its scalability and advanced traffic-handling features.

Key reasons to use Nginx for DDoS protection:

• High performance: Designed for concurrency and event-driven architecture.
• Rate limiting and connection control: Built-in modules help filter traffic.
• Reverse proxy support: Protects backend applications.
• Flexible rules: You can configure IP blocking, request limits, and custom error codes.
• Integration with Cpnginx: For cPanel users, Cpnginx offers a GUI-based configuration without requiring edits to raw Nginx files.

What Are the Different Types of DDoS Attacks?

Before diving into Nginx configurations, it’s important to know the types of DDoS attacks:

1. Volumetric Attacks: Flood network bandwidth with traffic (e.g., UDP floods).
2. Protocol Attacks: Exploit vulnerabilities in server protocols (e.g., SYN floods).
3. Application Layer Attacks: Target HTTP/HTTPS requests, such as Slowloris or HTTP floods.
4. Botnet Attacks: Automated malicious traffic from thousands of compromised devices.
5. Referrer Spam and Bad Bots: Bots that spam fake referrers or crawl excessively.

Nginx is particularly effective against application-layer DDoS attacks, which traditional firewalls may not be able to detect.

How Nginx Can Help to Prevent DDoS Attacks

Nginx acts as both a web server and a reverse proxy, allowing it to filter incoming requests before they reach your application. Using Nginx’s limit modules, timeout settings, and security rules, you can:

• Block excessive requests from a single IP.
• Limit concurrent connections.
• Drop suspicious traffic without overloading the server.
• Protect against specific attack vectors like Slowloris and Range-based exploits.
• Integrate WAF (Web Application Firewall) via ModSecurity.

With Cpnginx on cPanel, all of these can be configured from WHM → Cpnginx → Preferences → Firewall, making DDoS prevention easier for hosting providers and shared hosting users.

Learn how to prevent DDoS attacks with Nginx and cPanel Nginx (Cpnginx). Step-by-step guide covering connection limits, request rate limiting, bot protection, Slowloris defense, and ModSecurity WAF setup.

-- By Cpnginx Team

Steps to Prevent DDoS Attacks in Nginx

1) Limit Number of Traffic Connections from Visitor IP (Connection Rate Limit)

What It Means

• Every visitor (by IP address) can open multiple simultaneous connections to your website.
• In a DDoS attack, attackers often open hundreds or thousands of parallel TCP/HTTP connections to overload the server.
• Connection rate limiting in Nginx helps by restricting how many connections a single IP can open at the same time.
  

Example: If you set the limit to 10 connections per IP, a malicious user who tries to open 200 concurrent connections will get blocked after the first 10.

Why It’s Important

• Prevents DDoS Flooding: Stops a single bot from monopolizing server resources.
• Protects Fair Usage: Ensures no visitor consumes excessive bandwidth or connections.
• Low Overhead Defense: Nginx can drop connections before they reach backend apps (like PHP, Node.js, or databases).

On Cpnginx:

Go to WHM → Cpnginx → Preferences → Firewall → DDoS Protection and enable Limit Connection Module. Set the number of connections per IP.

On Standard Nginx:

Add to nginx.conf:

Reload Nginx:

2) Limit Number of Traffic Connections to a Website

When visitors access your website, their browsers or apps open multiple network connections to load pages, images, scripts, and other resources. While this is normal, too many simultaneous connections — either accidental or intentional (like in a bot attack) — can overload your web server.

To prevent abuse, web servers like Nginx allow you to set a maximum number of simultaneous connections per visitor IP address. This technique is known as connection limiting.

Sometimes, the attack comes not from one IP but from multiple IPs targeting the same website. In such cases, you should limit the number of concurrent connections per server (per virtual host).

Why Limit Connections?

1. DDoS Protection – Attackers often flood websites with thousands of connections to exhaust CPU, memory, and bandwidth. Limiting stops one attacker from consuming all resources.
2. Fair Usage – Ensures no single user or bot can hog server capacity, keeping the site responsive for everyone.
3. Stability & Performance – Prevents sudden spikes in connections from overwhelming backend services like PHP, MySQL, or Node.js.
4. Resource Efficiency – Unwanted connections are dropped early by Nginx before they reach the application layer.

How It Works in Practice

• Every visitor's IP is tracked by the server.
• If the number of open connections from that IP exceeds your defined limit, the server closes extra connections.
• Visitors with normal browsing behavior (like loading a few pages at once) are unaffected.
• Abusers (bots, scrapers, attackers) get blocked automatically.

On Cpnginx:

1. Go to WHM → Cpnginx → Preferences → Firewall.
2. Under DDoS Protection, enable Limit Connection Module.
3. Set the maximum number of connections allowed per virtual host (website).
   

On Standard Nginx:

Add to nginx.conf:

Reload Nginx:

Best Practices

• Normal websites/blogs → 10–20 connections/IP
• E-commerce → 20–30 (due to multiple product images and scripts)
• APIs/Streaming → 50–100 (because of parallel requests)
• Always monitor logs to fine-tune limits (avoid blocking legitimate heavy users).

3) Rate Limit Requests per Second from Visitor IP

When someone (or something) visits your website, their browser or application sends HTTP requests to your server — for pages, APIs, images, scripts, etc. Normally, a human visitor might make a few requests per second while browsing.

But malicious bots, scrapers, or DDoS attacks can fire hundreds or thousands of requests per second from a single IP address. This overwhelms the server, slows down performance, and can even cause downtime.

Rate limiting solves this by controlling how many requests per second (RPS) a visitor IP is allowed to make.

This prevents a single IP from overwhelming your server by sending too many requests per second.

On Cpnginx:

1. Navigate to WHM → Cpnginx → Preferences → Firewall.
2. Enable Rate of Request Module.
3. Set the request rate per second allowed from each visitor IP.
   

On Standard Nginx:

Why Rate Limit Requests?

1. Block Malicious Bots & Scrapers – Prevents automated tools from crawling your site aggressively.
2. Protect Against DDoS Attacks – Limits traffic spikes from attackers sending excessive requests.
3. Preserve Server Resources – Stops CPU, memory, and database from being overloaded by too many queries.
4. Ensure Fair Usage – Keeps the website fast and responsive for normal users.

Best Practices

• Blogs / Small Sites → 5–10 RPS is enough
• E-commerce / APIs → 20–50 RPS depending on traffic needs
• Login / Admin Pages → very strict (1–2 RPS) to prevent brute-force attacks
• Always allow some burst capacity so normal users aren’t blocked during fast clicks

4) Rate Limit Requests per Second to a Website

Every time someone loads your website, their browser or app sends multiple HTTP requests — for pages, images, CSS, JavaScript, or API calls.

While this is normal behavior, problems arise when:

• A bot or scraper sends hundreds of requests per second
• Attackers launch a Layer 7 DDoS attack by overwhelming your server with traffic
• A misconfigured script hammers your site with repeated requests
  

To stop this, web servers like Nginx support rate limiting, which controls how many requests per second a visitor (by IP address) is allowed to make.

Instead of per-IP, you can enforce request limits for the entire website, protecting against distributed request floods.

Why Limit Requests per Second?

1. Defend Against DDoS Attacks – Blocks excessive traffic before it crashes your server.
2. Stop Bots & Crawlers – Prevents scrapers from stealing content or data too quickly.
3. Protect Server Resources – Reduces load on CPU, memory, and backend databases.
4. Ensure Fair Usage – Keeps the site fast and reliable for genuine users.

How It Works

• You define a maximum requests per second (RPS) limit.
• Each visitor IP is tracked by Nginx in memory.
• If an IP exceeds the allowed RPS, extra requests are delayed or dropped.
• Legitimate visitors browsing normally won’t notice, but bots and attackers get blocked.

On Cpnginx:

• WHM → Cpnginx → Preferences → Firewall → Enable Rate of Request Module.
• Configure per-website (virtual host) request rate limits.
  

On Standard Nginx:

Best Practices

• Normal websites/blogs → 5–10 RPS
• E-commerce / APIs → 20–50 RPS (due to parallel requests)
• Login/Admin areas → 1–2 RPS for maximum security
• Always use a burst buffer to avoid blocking normal users who click fast

5) Protect from Slowloris DDoS Attack

A Slowloris attack is a type of Layer 7 (application-level) DDoS attack that targets web servers by opening hundreds or thousands of HTTP connections and keeping them open as long as possible.

Unlike typical DDoS attacks that flood the server with traffic, Slowloris is stealthy:

• It sends partial HTTP requests very slowly
• Keeps connections alive to consume server resources
• Prevents legitimate users from connecting because the server’s maximum connections are exhausted

Impact: Web pages load slowly or fail to load, while the attacker uses minimal bandwidth.

Why Nginx Can Stop Slowloris

Nginx is event-driven and highly efficient at handling concurrent connections. Unlike traditional web servers, it can:

• Limit the time a client takes to send request headers or body
• Drop slow connections automatically
• Protect server resources from being fully consumed

On Cpnginx:

• WHM → Cpnginx → Preferences → Firewall → Enable Slowloris DoS Protection.
• Set client_header_timeout and client_body_timeout.
  

On Standard Nginx:

Slowloris attacks are stealthy, low-bandwidth attacks designed to exhaust server connections. Nginx protects your server by:

• Limiting connection time
• Dropping slow requests
• Restricting simultaneous connections per IP

With Cpnginx, you can enable these protections easily via WHM without manually editing Nginx configs, making your website resilient against Slowloris attacks.

6) Protect from Range-Based Attacks

A Range-Based Attack (or HTTP Range Attack) is a type of application-layer (Layer 7) attack where attackers exploit the HTTP Range header to request partial content repeatedly.

• The Range header allows clients to request a specific part of a file (useful for resuming downloads or streaming).
• Attackers send multiple requests with overlapping or invalid ranges to consume server CPU and memory.
• Large or repeated range requests can slow down the server or cause crashes.
  

Impact: Normal users experience slow responses or errors while downloading content, streaming, or accessing your website.

Why Nginx Can Stop Range-Based Attacks

Nginx can block or sanitize malicious Range headers before they reach the backend. By clearing or validating the header, Nginx prevents attackers from overloading server resources.

On Cpnginx:

• WHM → Cpnginx → Preferences → Firewall → Enable Range Protection.
  

On Standard Nginx:

Best Practices

• Enable Range-Based Attack Protection on all servers that serve large files or media content.
• Combine with connection and request rate limits for layered protection.
• Monitor access logs for repeated Range requests to identify potential attackers.
• Test legitimate clients (like download managers) to ensure normal partial content requests are not blocked.

7) Limit HTTP Methods

Allow only safe methods (GET, POST, HEAD) to prevent abuse of unsupported HTTP methods.

What Are HTTP Methods?

HTTP methods (or verbs) define the action a client wants to perform on a web server. Common methods include:

• GET → Retrieve a resource
• POST → Submit data to the server
• HEAD → Retrieve headers only
• PUT / DELETE / PATCH / OPTIONS → Modify or delete resources
  

Problem: Some HTTP methods, like PUT or DELETE, are rarely needed for standard websites. Attackers can abuse them to:

• Exploit vulnerabilities
• Attempt file uploads or deletion
• Scan for security weaknesses

Why Limit HTTP Methods?

1. Prevent Malicious Access – Stops attackers from using unsafe methods to manipulate resources.
2. Reduce Attack Surface – Only allow necessary methods for your application.
3. Protect Against Layer 7 Attacks – Limiting methods blocks automated tools from exploiting unusual requests.
4. Improve Compliance – Many security standards recommend disabling unnecessary HTTP methods.

On Cpnginx:

• WHM → Cpnginx → Preferences → Firewall → Enable HTTP Method Limiting.
  

On Standard Nginx:

Best Practices

• Standard Websites / Blogs: Allow GET, HEAD, POST only
• APIs: Allow additional methods like PUT or PATCH, but limit to trusted endpoints
• Admin / Login Pages: Use strict method limitation to prevent abuse
• Combine with connection and request rate limits for layered protection
• Monitor access logs for blocked methods to detect malicious attempts

Limiting HTTP methods in Nginx helps reduce your server’s attack surface by:

• Blocking unnecessary or dangerous methods
• Preventing attackers from exploiting uncommon HTTP verbs
• Protecting against Layer 7 DDoS and automated attacks

With Cpnginx, enabling HTTP method restrictions is easy via WHM, making your websites safer without manual config edits.

8) Protect from Bad Bots DDoS Attacks

Not all bots are malicious. Examples of good bots include Googlebot, Bingbot, or monitoring tools like UptimeRobot.

Bad bots, however, can:

• Launch DDoS attacks by sending massive requests
• Scrape website content (text, images, APIs)
• Exploit vulnerabilities in plugins, forms, or APIs
• Generate fake traffic, impacting server performance

Impact: Bad bots can overwhelm your server, slow down legitimate users, and increase hosting costs.

Bad bots scrape, spam, or flood your server with fake requests. We already published an article about this.

Why Nginx Is Ideal for Blocking Bad Bots

• Nginx can inspect user-agent headers and filter bots before they reach the backend.
• Lightweight and efficient: drops requests without consuming excessive resources.
• Can distinguish good bots vs bad bots using mappings and rules.
  

On Cpnginx:

• WHM → Cpnginx → Preferences → Firewall → Enable User-Agent Attack Protection.
  

Advantages:

• No manual editing of nginx.conf or virtual host files
• Automatic updates for new domains added in cPanel
• Protection works immediately

On Standard Nginx:

Best Practices

• Regularly update the list of bad bots to include new threats
• Always whitelist legitimate crawlers to avoid SEO impact
• Combine with connection limits, request rate limits, and HTTP method restrictions for layered security
• Monitor logs for blocked bots to identify suspicious patterns

9) Referrer Spam Protection

Referrer spam occurs when bots send fake HTTP referrer headers to your website. These appear in your analytics reports and can:

• Inflate traffic metrics artificially
• Trick you into visiting spammy websites
• Waste server resources if the bots make repeated requests

Impact: Analytics data becomes unreliable, and server performance may degrade if spam requests are excessive.

With Cpnginx (cPanel + Nginx)

1. Go to WHM → Cpnginx → Preferences → Firewall
2. Enable Referrer Spam Protection
3. Save settings → Cpnginx updates Nginx configs automatically for all virtual hosts

Advantages:

• No manual editing required
• Works across multiple websites hosted on the server
• Protects both analytics accuracy and server performance

On Standard Nginx:

Best Practices

• Regularly update the spam referrer list based on new threats
• Test legitimate referral traffic to avoid false positives
• Combine with other DDoS and bot protections for layered security
• Monitor Nginx access logs for blocked referrers to identify potential attacks

Referrer spam protection ensures:

• Accurate analytics reporting
• Reduced server load from unnecessary requests
• Protection against spam bots and Layer 7 DDoS amplification

With Cpnginx, enabling referrer spam protection is simple and effective across all hosted sites.

10) Block IPs Using Nginx

What Does It Mean to Block IPs?

Blocking IPs is a common technique to prevent unwanted visitors from accessing your website. This can include:

• Malicious bots launching DDoS attacks
• Hackers attempting brute-force attacks
• Spammers submitting forms or scraping content

Impact: By blocking these IPs, you reduce server load, improve security, and ensure legitimate users can access your site without interruptions.

Why Nginx Is Ideal for IP Blocking

• Nginx can efficiently block single IPs or ranges at the web server level
• Requests from blocked IPs are dropped before reaching backend applications, saving CPU and memory
• Works for all types of traffic: HTTP, HTTPS, APIs

With Cpnginx (cPanel + Nginx)

1. Go to WHM → Cpnginx → Preferences → IP Deny
2. Add the IP address or range you want to block
3. Click Save → Cpnginx updates Nginx configuration automatically

Advantages:

• Easy to manage multiple blocked IPs from WHM
• Applies to all virtual hosts without editing nginx.conf manually
• Effective against malicious bots, spammers, and DDoS sources

On Standard Nginx:

a) Deny a single IP or a Range of IPS

b) Only allow some IPs and deny the remaining IPS

11) Configure Nginx Keep-Alive Settings

What is Keep-Alive?

Keep-Alive is a feature in HTTP that allows a single TCP connection between the client and server to be reused for multiple requests instead of opening a new connection for every request.

Benefits:

• Reduces latency by avoiding TCP handshakes for each request
• Saves CPU and memory resources on the server
• Improves page load times for visitors
• Efficient for websites serving multiple assets (images, CSS, JS)
  

Why Adjust Keep-Alive Settings in Nginx?

1. Prevent Slow Connection Abuse: Attackers can exploit long-lived connections to exhaust server resources.
2. Optimize Resource Usage: Proper keep-alive settings balance server performance and user experience.
3. Improve Speed for Legitimate Users: Faster loading pages for users accessing multiple resources.

With Cpnginx (cPanel + Nginx)

• Go to WHM → Cpnginx → Preferences → Firewall → Keep-Alive
• Set:

1. keepalive_requests (e.g., 100)
2. keepalive_timeout (e.g., 60s)

• Save settings → Cpnginx automatically updates all virtual hosts with these parameters

Advantages:

• Easy to manage globally without editing individual Nginx configs
• Immediate effect for all hosted websites
• Protects against slow connection attacks while improving legitimate traffic performance
  

On Standard Nginx:

Best Practices

• Static websites or small blogs: keep keepalive_requests 50–100, keepalive_timeout 30–60s
• High-traffic websites: adjust keepalive_requests higher for caching-heavy pages
• Sensitive admin areas: lower keepalive_timeout to prevent resource abuse
• Combine with Slowloris and rate limiting protections for layered security

Properly configured Keep-Alive settings in Nginx:

• Improve server performance
• Reduce latency for visitors
• Protect against slow connection attacks

With Cpnginx, these settings are easy to enable via WHM, giving you optimized and secure web performance without manual Nginx edits.

12) Use Nginx ModSecurity Rules

ModSecurity is a Web Application Firewall (WAF) that helps protect web applications from attacks by analyzing HTTP requests and responses.

It can block:

• SQL injection attempts
• Cross-site scripting (XSS) attacks
• Bad bot requests
• Malicious file uploads
• Layer 7 DDoS attacks
  

Impact: ModSecurity prevents attackers from exploiting vulnerabilities, protecting both the server and application.

ModSecurity acts as a Web Application Firewall (WAF), blocking SQL injection, XSS, and malicious payloads.

With Cpnginx (cPanel + Nginx)

1. Go to WHM → Cpnginx → Preferences → Settings → Default Module Settings
2. Enable ModSecurity globally
3. Go to WHM → Cpnginx → Modules → ModSecurity (WAF)
4. Select domains to enable or disable protection
   

Advantages:

• No manual Nginx edits required
• Easy per-domain control for large cPanel servers
• Works alongside other Cpnginx protections like rate limits, bad bot protection, and Slowloris defense

On Standard Nginx:

• Install ModSecurity with Nginx:

Enable in nginx.conf:

Best Practices

• Use OWASP Core Rule Set (CRS) for general protection
• Regularly update ModSecurity rules to protect against new attack vectors
• Combine with rate limiting, HTTP method restrictions, and bad bot protection for layered security
• Monitor ModSecurity logs to identify and fine-tune rules for false positives

Using ModSecurity with Nginx provides:

• Application-layer protection against SQLi, XSS, and other attacks
• Real-time monitoring and logging of suspicious activity
• Seamless integration with Cpnginx for cPanel servers
  

With Cpnginx, enabling ModSecurity is easy, providing robust WAF protection without manual Nginx configuration.

Summary

DDoS protection is not a single configuration—it’s a layered approach. With Nginx, you can combine connection limits, request rate limits, HTTP method restrictions, and WAF rules to effectively mitigate attacks.

For cPanel users, Cpnginx makes it much easier by providing a user-friendly interface in WHM to configure firewall and DDoS modules without editing raw configuration files. Whether you’re running a single website or a hosting business, combining Nginx + Cpnginx ensures better security, stability, and uptime.

Frequently Asked Questions

Q1: What is a Layer 7 DDoS attack?
A1: Layer 7 attacks target the application layer of your website, overwhelming it with HTTP requests to slow down or crash the server.

Q2: How does Nginx prevent DDoS attacks?
A2: Nginx can limit connections, rate-limit requests, block bad bots, restrict HTTP methods, and defend against Slowloris or range-based attacks.

Q3: Can I use Cpnginx to protect my websites?
A3: Yes. Cpnginx allows you to configure all DDoS protection settings via WHM, including connection limits, rate limits, bad bot protection, and ModSecurity rules.

Q4: What is the difference between limiting connections from a visitor IP and to a website?
A4: Limiting connections from a visitor IP restricts the number of simultaneous connections per user, while limiting connections to a website restricts total concurrent connections to a virtual host.

Q5: How can I protect against Slowloris attacks using Nginx?
A5: Configure client_header_timeout and client_body_timeout to close slow connections, or enable Slowloris protection in Cpnginx via WHM.

Q6: What are Range-based attacks and how can I prevent them?
A6: Range-based attacks exploit the HTTP Range header to overload servers. Nginx can clear or block Range headers, and Cpnginx has a dedicated Range Protection module.

Q7: How do I block bad bots using Nginx?
A7: Use Nginx map to define bad user agents and block them with return 449. Cpnginx provides a GUI option to enable Bad Bot Protection.

Q8: How do I limit HTTP methods for security?
A8: Allow only GET, POST, and HEAD using a map in Nginx and block others with return 444. Cpnginx enables this via the firewall preferences.

Q9: What is ModSecurity and why should I use it?
A9: ModSecurity is a Web Application Firewall (WAF) that blocks SQLi, XSS, and other attacks at the HTTP layer. It integrates with Nginx or Cpnginx for automated protection.

Q10: How do I configure Keep-Alive settings in Nginx?
A10: Use keepalive_requests and keepalive_timeout in the server block. Cpnginx allows you to configure it globally via WHM.