Apache HTTP Server 2.4’s mod_ratelimit is an extension module that limits bandwidth for each HTTP response as it transfers to a client. It does not aggregate traffic at the IP or client level.
How mod_ratelimit Works
The module provides an output filter named RATE_LIMIT. Its settings come from environment variables:
rate-limitsets the simulated connection speed in KiB/s.rate-initial-burstoptionally sets an initial amount of data in KiB that can pass at full speed before throttling begins.
Because the limit is applied to each HTTP response, simultaneous downloads receive the configured limit separately. The module does not provide a global throughput or concurrency limit for an IP address or client.
Configuration Example
This example applies the RATE_LIMIT output filter to requests under /downloads:
<Location "/downloads">
SetOutputFilter RATE_LIMIT
SetEnv rate-limit 400
SetEnv rate-initial-burst 512
</Location>For matching responses, Apache permits an initial burst of 512 KiB at full speed, then limits the remaining transfer to 400 KiB/s. The initial burst setting is optional. The module itself provides no custom directives; this configuration uses the output filter and environment variables.
Compatibility Limits
rate-initial-burstis available in httpd 2.4.24 and later.- Rate limiting proxied content does not work correctly up to httpd 2.4.33.
Research Scope and Limitations
This answer was prepared from the supplied public excerpt of the Apache HTTP Server 2.4 mod_ratelimit documentation. No independent testing or server benchmarking was performed. No competing coverage was available for comparison, and the answer does not claim findings beyond the supplied excerpt.
Text version of the diagrams
- Per-response bandwidth scope: Each response — Gets its own rate limit; Client or IP — No aggregate limit; RATE_LIMIT — Output filter applies
- Burst before steady rate: Initial burst — Optional data at full speed; Configured rate — Remaining data is limited; No burst — Rate applies immediately
