Rate Limiting & Throttling in LiteSpeed

LiteSpeed has built-in connection throttling and request rate limiting that works at the web server layer: before PHP or your application is even invoked.

Connection throttling

Throttling limits how many simultaneous connections and how much bandwidth a single IP can use.

Configure in LiteSpeed WebAdmin (https://YOUR_IP:7080):

Server → Tuning → Connection Throttling:

Setting	Recommended	Effect
Max Connections per IP	20	Limits simultaneous connections per client
Connection Soft Limit	10	Starts throttling at this count
Connection Hard Limit	20	Drops connections above this
Block Bad Requests	Yes	Rejects malformed HTTP
Grace Period	15s	How long to track connections

Per-directory request limits (.htaccess)

LiteSpeed supports mod_limitipconn-style limits via .htaccess:

# Limit connections to this directory
LimitRequestBody 10485760
# Max 10 MB uploads

# Rate limit specific paths (wp-login.php brute force)
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} ^/wp-login\.php
RewriteCond %{HTTP:X-Rate-Limit-Status} blocked
RewriteRule ^ - [R=429,L]
</IfModule>

WordPress brute-force protection

Combine LiteSpeed throttling with .htaccess rules to protect wp-login.php:

# In wp-login.php's directory or site root
<Files wp-login.php>
    Order Deny,Allow
    # Allow only your office IP if consistent:
    # Allow from YOUR_OFFICE_IP
    # Deny from all
    # Or use rate limiting via LiteSpeed:
    LsapiThrottleMaxConns 3
</Files>

A more robust solution: use Imunify360 (already active on your server) which handles WordPress brute-force automatically.

Rate limiting the REST API

WordPress REST API endpoints (/wp-json/) can be hammered by bots. Limit them:

<IfModule mod_rewrite.c>
RewriteEngine On
# Block requests hitting REST API too frequently
RewriteCond %{REQUEST_URI} ^/wp-json/
RewriteCond %{HTTP:X-Forwarded-For} ^(.+)$
RewriteRule ^ - [L]
</IfModule>

LiteSpeed Anti-DDoS settings

In WebAdmin → Server → Security → Per-Client Throttling:

Setting	Value	Effect
Static Requests Per Second	50	Max static file requests per IP/sec
Dynamic Requests Per Second	10	Max PHP requests per IP/sec
Outbound Bandwidth per IP	512 KB/s	Max download speed per connection
Inbound Bandwidth per IP	1024 KB/s	Max upload speed per connection

Dynamic request limiting is the most important: it prevents bots from triggering thousands of PHP executions per second which would spike CPU.

Monitoring blocked requests

Check LiteSpeed logs for throttled connections:

tail -f /usr/local/lsws/logs/error.log | grep -i "throttl\|limit\|block"

Or in WebAdmin → Reports → Real-Time Statistics → watch the throttled connections counter.