{
  "id": 15652166,
  "title": "Why I rate-limit every self-hosted service (and you should too)",
  "url": "https://urgent.news/2026/10/19/why-i-rate-limit-every-self-hosted-service-and-you-should-too",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-19T20:52:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/scsoi/why-i-rate-limit-every-self-hosted-service-and-you-should-too-4n6b"
  },
  "original_language": "en",
  "account": "The author emphasizes the importance of rate-limiting every self-hosted service to prevent various types of attacks. He learned this lesson the hard way, as an exposed instance of Jellyfin without rate-limiting became vulnerable to credential stuffing bots. To mitigate these threats, he uses fail2ban on all public-facing services, monitoring log files for failed login patterns and banning offending IP addresses at the firewall level.\n\nThe author outlines a generic fail2ban configuration for most services and provides specific jails for applications like Jellyfin, Vaultwarden, and Plex. For services that already have built-in brute-force protection, he layers fail2ban on top for additional security. He also uses Nginx to rate-limit login attempts at the reverse-proxy level, further limiting the number of requests from a single IP.\n\nFor services hosted behind Cloudflare, he takes advantage of the free tier's DDoS protection, bot management, and rate limiting rules to add another layer of defense. He logs ban events to a centralized Loki/Grafana setup and escalates the bantime or blocks entire IP ranges if needed.\n\nThe author acknowledges that rate-limiting does not protect against zero-day exploits, compromised credentials, or attacks via VPNs. To address these concerns, he recommends patching services quickly, using two-factor authentication (2FA) on all accounts, and considering VPN-only exposure's inherent risks.\n\nOverall, the author argues that the cost of implementing these measures is minimal (around $0 and ~3 hours of one-time setup), while the benefits are significant. He concludes that following these five steps will make self-hosted services far safer than 95% of other homelabs.",
  "summary": "I learned this the hard way: an exposed Jellyfin or Vaultwarden instance without rate-limiting is a free buffet for credential stuffing bots. This is the setup I now apply to every public-facing self-hosted service. What rate-limiting actually prevents Brute-force login attacks : bots trying common passwords on /login endpoints API abuse : scrapers hitting your Immich or Paperless APIs at 100…",
  "key_points": [
    "Rate-limit every self-hosted service to prevent attacks",
    "Use fail2ban on public-facing services to ban IPs",
    "Leverage Nginx and Cloudflare for additional rate-limiting"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}