Configure mod_evasive to Help Against Request Floods on Apache

Updated: 28 September 2026 · Applies to: mod_evasive 1.10 and 2.4 with Apache 2.4 on Ubuntu 24.04 and 26.04 and Debian 13; notes for AlmaLinux and Rocky Linux

mod_evasive is an Apache module that blocks a client IP address for a short time when it requests too many pages too quickly. It helps against small floods, aggressive crawlers and brute-force attempts on a single server. It cannot stop a real distributed denial-of-service attack: by the time traffic reaches Apache, the server's connection is already saturated. Large attacks must be filtered upstream, by your provider's network protection or a service such as a CDN.

Install on Ubuntu and Debian

apt install libapache2-mod-evasive
a2enmod evasive
systemctl restart apache2

Ubuntu 24.04 packages version 1.10.1; Debian 13 and Ubuntu 26.04 package version 2.4.0. We checked the configuration with Apache 2.4.68 on Debian 13.

Configure it

The settings are in /etc/apache2/mods-available/evasive.conf, all commented out by default. A reasonable start:

<IfModule mod_evasive.c>
    DOSHashTableSize    3079
    DOSPageCount        10
    DOSSiteCount        100
    DOSPageInterval     1
    DOSSiteInterval     1
    DOSBlockingPeriod   60
    DOSLogDir           "/var/log/mod_evasive"
    DOSWhitelist        127.0.0.1
</IfModule>

• DOSPageCount and DOSPageInterval: more than 10 requests for the same page within 1 second blocks the client.
• DOSSiteCount and DOSSiteInterval: more than 100 requests to the whole site within 1 second blocks the client.
• DOSBlockingPeriod: blocked clients get "403 Forbidden" for 60 seconds, extended while they keep trying.
• DOSWhitelist: addresses never blocked, such as your monitoring or office IP.

Create the log folder for the web server user, then check and restart:

mkdir -p /var/log/mod_evasive && chown www-data: /var/log/mod_evasive
apache2ctl configtest && systemctl restart apache2

Tune it carefully

Pages that load many small files (images, scripts, fonts) quickly reach the page and site counts, especially behind a single office NAT address. Start with high limits, watch /var/log/mod_evasive and the Apache logs for blocked visitors, and lower them step by step. Behind a proxy or CDN, all requests appear to come from the proxy's addresses; mod_evasive would then block the proxy, so use mod_remoteip to restore the real client address first.

AlmaLinux and Rocky Linux

mod_evasive is not in the AlmaLinux, Rocky Linux or EPEL repositories for version 9 or 10. Instead, limit request rates with ModSecurity rules, fail2ban watching the Apache logs, or rate limiting in an Nginx proxy in front of Apache (limit_req).

Official documentation: mod_evasive on GitHub and mod_remoteip.