I tried to get to our website an hour ago and found it down [image] this looks like an attack to me, how we can stop, cloudflare is a good option for such a scenarios but that service is not suitable for discourse, please advise.

I’m also just suffered this on https://se23.life - seems coincidental that I’d suffer an attack at the same time as @Jay91 ?

Did standard install yes ! is there any way i can turn around and use cloudflare ? i trust that service a lot.

Are you using a reverse proxy on the same server? Is anything else installed? Cloudflare can’t help you here.

The problem is most likely that you have some mis-configuration that is falsely triggering the built-in free rate limiting protection. If you don’t have a reverse proxy, do you have a whole bunch of people who are accessing your site from the same NATed IP number (e.g., a single business or university?) if you were to use CloudFlare, you’d need to enable a template that re-writes headers so that the real IP is reported to Discourse.

That’s an nginx rate limiting error, configured in the templates section of app.yml: templates: - "templates/postgres.template.yml" - "templates/redis.template.yml" - "templates/web.template.yml" - "templates/web.ratelimited.template.yml" It’s the web.ratelimited.template.yml template and it configures nginx rate limiting like so: params: reqs_per_second: 12 burst_per_second: 12 reqs_per_minute: 200 burst_per_minute: 100 conn_per_ip: 20 run: - replace: filename: "/etc/nginx/conf.d/discourse.conf" from: /server.+{/ to: | limit_req_zone $binary_remote_addr zone=flood:10m rate=$reqs_per_secondr/s; limit_req_zone $binary_remote_addr zone=bot:10m rate=$reqs_per_minuter/m; limit_req_status 429; limit_conn_zone $binary_remote_addr zone=connperip:10m; limit_conn_status 429; server { - replace: filename: "/etc/nginx/conf.d/discourse.conf" from: "/location @discourse {/" to: | location @discourse { limit_conn connperip $conn_per_ip; limit_req zone=flood burst=$burst_per_second nodelay; limit_req zone=bot burst=$burst_per_minute nodelay; If you’re running a reverse proxy you’ll need to ensure the real IP is being passed along, but you can also edit the above template to be more accommodating, not that you’ll need to if your real IP’s are being forwarded.

[image] Jay91: cloudflare is a good option for such a scenarios but that service is not suitable for discourse Srly ? Why cloudflare is not suitable for discourse ?? What should i use then ?

Search here for “cloudflare problem”. It is quite possible to make it work, but it is not simple.

I use cloudflare with multiple Discourse installs, it works perfectly fine. My setup is Cloudlare > nginx reverse proxy > LXD > Docker > Discourse

Best free option to protect discourse from many requests

Product Support Self-hosting

pfaffman (Jay Pfaffman) April 3, 2019, 2:37pm 2

Did you do a standard install? Most likely the ip address of the requester is wrong and falsely triggering rate limits.

Topic		Replies	Views
Using Discourse with Cloudflare: Best Practices Self-Hosting how-to , cloudflare	28	6561	April 26, 2026
Discourse & Cloudflare Self-hosting	48	6122	January 26, 2024
429 too many requests good or bad ? (please help) Self-hosting	14	425	August 25, 2026
429 too many requests Self-hosting	4	2901	September 13, 2019
Cloudflare or plugins breaking my Discourse instance? Product Support	19	2666	May 10, 2020

Best free option to protect discourse from many requests

Related topics