How to Stop Slowloris Attacks on Web Servers

A Slowloris attack is a targeted denial-of-service technique where an attacker ties up server resources by opening numerous concurrent HTTP connections and keeping them open as long as possible with slow, fragmented requests. Unlike volumetric distributed denial-of-service (DDoS) attacks that rely on overwhelming network bandwidth, Slowloris exploits the connection concurrency limits of thread- and process-based web servers. Protecting against this vector requires a combination of aggressive timeout configurations, connection rate limiting, modern multi-processing modules, and the strategic deployment of reverse proxies or Web Application Firewalls (WAFs).

Understanding the Attack Mechanism

Traditional web servers, like standard configurations of Apache HTTP Server, allocate a dedicated worker thread or process to each incoming connection. In a Slowloris attack, the client sends incomplete HTTP headers at regular intervals (for example, every 10 to 15 seconds) to prevent the connection from timing out. Because the headers are never fully completed, the server keeps the socket open, waiting for the remainder of the request. Once the server reaches its maximum concurrent connection limit (MaxRequestWorkers), it can no longer accept legitimate incoming traffic, resulting in a denial of service.

Mitigating Slowloris in Apache HTTP Server

Because Apache traditionally operates on a thread- or process-per-connection model, engineers apply targeted configurations to mitigate connection exhaustion:

Deploy and Configure mod_reqtimeout: The mod_reqtimeout module is the primary defense inside Apache. It sets strict requirements on how fast a client must transmit request headers and bodies. If a client sends data too slowly, the server drops the connection.
```
<IfModule mod_reqtimeout.c>
  RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
</IfModule>
```
This configuration gives the client an initial 20 seconds to complete the headers, extending up to 40 seconds as long as data is transmitted at a minimum rate of 500 bytes per second.
Switch to the Event MPM: Switching from the legacy prefork or worker Multi-Processing Module (MPM) to mpm_event offloads idle and slow keep-alive connections to a single listening thread, freeing worker threads to handle active requests.
Rate Limiting with mod_qos or mod_evasive: Additional modules like mod_qos allow administrators to define global connection limits, maximum connections per IP address, and dynamic bandwidth restrictions.

Mitigating Slowloris in Nginx

Nginx uses an asynchronous, event-driven architecture by default, making it inherently more resilient to Slowloris attacks than thread-based servers. Thousands of slow connections can be maintained without exhausting system memory or threads. However, engineers still tune timeouts and buffer configurations to prevent resource leakage:

Shorten Client Timeouts: Reducing the time Nginx waits for request headers and bodies forces slow clients to drop:
```
client_body_timeout 10s;
client_header_timeout 10s;
keepalive_timeout 15s;
send_timeout 10s;
```
Limit Concurrent Connections per IP Address: Using the limit_conn module restricts the number of active connections originating from a single client IP:
```
limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;

server {
    ...
    limit_conn conn_limit_per_ip 20;
}
```

Deploying Reverse Proxies and Load Balancers

Placing an event-driven reverse proxy, such as HAProxy or Nginx, in front of backend application servers effectively shields them from Slowloris attacks. Reverse proxies buffer incoming HTTP requests completely before forwarding them to the upstream application servers. The application server only receives requests that are fully formed and ready to process, eliminating prolonged idle waiting states.

Firewall and Network-Level Defenses

Network administrators can enforce connection limits at the operating system or firewall level using tools like iptables or cloud security groups. By setting a ceiling on the number of concurrent connections an individual IP can establish on ports 80 and 443, automated Slowloris scripts running from single source addresses are quickly neutralized:

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 30 -j DROP

For broader protection against distributed variations of this attack, utilizing a cloud-based WAF or DDoS mitigation service provides dynamic traffic filtering that identifies and terminates slow-rate behavioral anomalies before traffic reaches the origin infrastructure.