rate-limiter-flexible
Flexible rate limiter for Node.js to protect against brute-force and DDoS attacks.
- Status
- Generally available
- Last checked
- Aging · Sep 2, 2026
- License
- Open source
- Pricing
- Free tier · from $0
What it is
Rate Limiter Flexible is a powerful tool that helps developers protect their applications from brute-force and DDoS attacks by limiting the number of requests from individual clients. It's highly customizable, making it suitable for various use cases in web development.
Rate Limiter Flexible offers a flexible and customizable approach to rate limiting in Node.js applications, making it an ideal choice for developers who need robust protection against DDoS and brute-force attacks without being tied to specific cloud services.
When it fits — and when it doesn’t
A good fit for
Developers building Node.js applications who need to protect against DDoS and brute-force attacks.
Teams working with Express.js or other Node.js frameworks that require rate limiting functionality.
Look elsewhere if
Projects requiring real-time analytics on request patterns (rate-limiter-flexible focuses on protection, not analysis).
Applications where the overhead of setting up a storage backend like Redis would be prohibitive.
Known weaknesses
Each one links to the public issue, changelog or docs page it came from, where we have one.
- 01
Limited third-party storage backend support beyond Redis and Memory
Documentation highlights Redis and in-memory options, but lacks extensive support for other databases or cloud services
- 02
Small community size leading to slower issue resolution
GitHub repository has a low number of contributors and infrequent activity on issues and pull requests
What it does well
Highly customizable rate limiting rules
Supports various storage backends (Redis, Memory)
Flexible time windows for rate limits
Easy integration with Express.js and other Node.js frameworks
Pricing
- Free tier
- YesOpen source — free to use
- Paid from
- $0
- Model
- Flat rate
- Enterprise plan
- No
Pricing not independently confirmed — check the vendor’s page.
Performance benchmarks
How Fast Is It?
Set up rate-limiter-flexible
Setup steps, common gotchas and what to check after 30 days.