Rate-Limit Placement SOP

Rate-Limit Placement SOP
Edge rate-limiting vs nginx limit_req vs app-level throttle. Layer by cost.

— Use edge limits (Cloudflare, fastly) for crude volume: cheapest place to drop a flood before it costs you bandwidth.
— Use nginx limit_req_zone for path-specific caps: wp-login.php at 1r/s, /xmlrpc.php blocked, API at 10r/s. Runs before PHP spins up.
— Use app-level throttle (Laravel throttle, plugin) when: limits must key on authenticated user ID, not just IP.
— Verify burst settings: a too-tight burst breaks legit users behind shared NAT.
— Confirm: hammer the login path, watch the 429s appear at nginx, not in PHP error logs.

Run this on every public form endpoint.