# Managing IP request rate limits in Discourse

**URL:** <https://meta.discourse.org/t/managing-ip-request-rate-limits-in-discourse/385608>\
**Category:** Self-Hosting\
**Created:** [2025 年 10 月 14 日午後 8:55 UTC](https://meta.discourse.org/t/managing-ip-request-rate-limits-in-discourse/385608 "2025-10-14T20:55:59Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)\
**Post date:** [2025 年 10 月 14 日午後 8:55 UTC](https://meta.discourse.org/t/managing-ip-request-rate-limits-in-discourse/385608/1 "2025-10-14T20:55:59Z")

</div>

Discourse implements global per-IP rate limits to protect sites from excessive traffic and abuse.  
In some legitimate cases, however, you may need to **allowlist certain IPs** so they can bypass these limits and prevent errors such as [`#{error_code_identifier}_10_secs_limit`](https://github.com/discourse/discourse/blob/main/lib/middleware/request_tracker.rb#L417-L448) (e.g., `Error code: cloud_10_secs_limit`).

This guide explains how to configure exceptions for rate limiting on self-hosted Discourse installations.

## Adding IP addresses to the allowlist

When you need to increase global per-IP rate limits for specific IPs or IP ranges, you’ll need to modify your container configuration file (`app.yml`) by adding the `DISCOURSE_MAX_REQS_PER_IP_EXCEPTIONS` environment variable.

> **Warning** : Remember that even though the variable _says_ “IP” it really means “bucket”, so could be an [IP](https://github.com/discourse/discourse/blob/main/lib/request_tracker/rate_limiters/ip.rb), a [user](https://github.com/discourse/discourse/blob/main/lib/request_tracker/rate_limiters/user.rb), or something else if a [new classification type](https://github.com/discourse/discourse/blob/main/lib/request_tracker/rate_limiters/base.rb) is added by a plugin

### Adding a single IP address

To add a single IP address to your allowlist:

```yaml
DISCOURSE_MAX_REQS_PER_IP_EXCEPTIONS: 192.168.1.100

```

This will exempt the IP address `192.168.1.100` from the standard rate limiting rules.

### Adding multiple IP addresses or CIDR ranges

For multiple IPs or IP ranges using CIDR notation, use the multi-line format with the `>-` YAML syntax:

```yaml
DISCOURSE_MAX_REQS_PER_IP_EXCEPTIONS: >-
  10.0.0.0/24
  172.16.10.0/16
  192.168.1.50
  2001:db8:c0:ffee::/64

```

This configuration exempts:

- the entire `10.0.0.0/24` network (256 IP addresses)
- the entire `172.16.10.0/16` network (65,536 IP addresses)
- the single IP address `192.168.1.50`
- the entire `2001:db8:c0:ffee::/64` network (IPv6)

> ⚠ Ensure proper YAML formatting, particularly when using the multi-line syntax with `>-`

### Rebuild

After modifying the container configuration, you’ll need to rebuild the container for changes to take effect:

```plaintext
cd /var/discourse
./launcher rebuild app

```

## Security considerations

Be cautious when adding IP addresses to the allowlist. Each exempted IP or range bypasses Discourse’s built-in protection against abuse and excessive traffic.

### Best practices:

- Only allowlist IPs that have a legitimate business need (e.g., monitoring services, API integrations, trusted partners)
- Use the most specific IP ranges possible rather than large networks
- Regularly review your allowlist and remove IPs that no longer require exemption

Remember: an overly permissive allowlist can expose your site to potential abuse or denial-of-service scenarios.

## Troubleshooting

If you’re still experiencing rate limit errors despite configuring exceptions:

1. verify the correct IP addresses are being used in your configuration
2. check that the container was properly rebuilt after the configuration change
3. examine the Discourse logs for rate limit messages related to the IPs in question
4. if you are using a proxy/load balancer, ensure that is correctly forwarding the original client IP

---

_[View the full topic](https://meta.discourse.org/t/managing-ip-request-rate-limits-in-discourse/385608)._