Rate Limiting in PHP: How to Protect Your API from Overloads and Bots

Rate Limiting and Throttling in PHP: Tame the Flow of Requests

Imagine: you've launched a cool API for your service. Everything works perfectly until one "rogue" client starts hammering your server with thousands of requests per second. Or, even worse, a bot-parser decides to scrape your entire database. Sound familiar? If not, you're lucky. But it's better to be prepared. This is where rate limiting and throttling come on stage — two knights that will protect your backend from overloads.

In this article, we'll figure out how to implement request limiting in PHP, look at real code examples, and understand which method to choose for your project. Spoiler: you won't have to reinvent the wheel, but knowing the basic algorithms is useful.

Rate Limiting vs Throttling: What's the Difference?

These terms are often used interchangeably, but there is a fine line between them.

\n
• Rate Limiting — is a hard limit. You say: "Maximum 100 requests per minute". Once the limit is exhausted, the client receives HTTP 429 Too Many Requests and goes to have a cup of tea.
\n
• Throttling — is a softer control. Instead of blocking, you simply slow down the processing of requests exceeding the limit, put them in a queue, or lower their priority.
\n

In practice, throttling in PHP is often implemented through delays (sleep) or queues, while rate limiting is implemented by counting requests per unit of time. For most API gateways, a combination of both approaches is optimal.

Why Is This Critically Important for Your Project?

There are at least three reasons to implement PHP request limiting:

\n
• Protection from DDoS and bots — even a simple script can take down a server if the call frequency is not controlled.
\n
• Fair resource distribution — one "greedy" client should not deprive other users of the service.
\n
• Stability and predictability — you know what peak load to expect and can properly configure your infrastructure.
\n

Rate Limiting Algorithms: Choosing a Strategy

Before writing code, let's look at three popular algorithms. Each has its pros and cons.

1. Fixed Window

The simplest approach. Divide time into segments (e.g., by minutes). Remember how many requests came in the current window. Reach the limit — block until the next window.

Disadvantage: a burst is possible at the window boundary — a client can send 100 requests at the end of one minute and another 100 at the beginning of the next, resulting in 200 requests in 2 seconds.

2. Sliding Window

A more accurate algorithm. Instead of fixed segments, we look at the last N seconds. Requests "age" and fall out of the window. This eliminates bursts at boundaries.

3. Token Bucket

An elegant algorithm from the networking world. Tokens are placed in a "bucket". Each request takes one token. Tokens are replenished at a set rate. If the bucket is empty, the request is rejected. It's great for php throttling as it allows small traffic bursts.

Practical Implementation: From Simple to Complex

Let's move on to the code. We'll start with a basic file-based example, then look at industrial solutions.

Basic File-Based Rate Limiter (for Learning)

This example uses files to store counters. Not suitable for production, but perfectly demonstrates the principle.

<?php\nclass SimpleRateLimiter {\n    private string $storageDir;\n    private int $maxRequests;\n    private int $windowSeconds;\n\n    public function __construct(string $storageDir, int $maxRequests = 100, int $windowSeconds = 60) {\n        $this->storageDir = rtrim($storageDir, '/') . '/';\n        $this->maxRequests = $maxRequests;\n        $this->windowSeconds =