# How do you actually set up rate limiting in HAProxy?

We need to protect a few APIs and login endpoints from spikes and abuse. I'm interested in how rate
limits are defined, whether they can vary by user or endpoint, and how manageable the configuration is.

##### Post Metadata
- Posted at: 21 days ago
- Net upvotes: 2


## Comments
### Comment 1

Rate limiting is native, built on a feature called stick tables. You choose a key to track by, such as client IP, URL, or a custom value, then set thresholds that trigger actions like delaying or denying requests once a client crosses them. It is commonly used to stop brute-force attempts, abusive scrapers, and sudden traffic spikes, all in the load balancer configuration with no external dependency. In HAProxy Enterprise, this extends to global rate limiting coordinated across an entire cluster.
Learn more on our DDoS protection and rate limiting solution page - https://www.haproxy.com/solutions/ddos-protection-and-rate-limiting

##### Comment Metadata
- Posted at: 20 days ago




## Related Product
[HAProxy](https://www.g2.com/products/haproxy/reviews)

## Related Category
[Load Balancing](https://www.g2.com/categories/load-balancing)

## Related discussions
- [How well does Trello scale into a larger team?](https://www.g2.com/discussions/1-how-well-does-trello-scale-into-a-larger-team)
  - Posted at: over 13 years ago
  - Comments: 6
- [Can we please add a new section](https://www.g2.com/discussions/2-can-we-please-add-a-new-section)
  - Posted at: over 13 years ago
  - Comments: 0
- [Quantifiable benefits from implementing your CRM](https://www.g2.com/discussions/quantifiable-benefits-from-implementing-your-crm)
  - Posted at: over 13 years ago
  - Comments: 4