PHP Advanced Concepts: Implementing a Custom PHP Rate Limiter

By Robert F1 min readMarch 24, 2026

To create our rate limiter, we will utilize PHP's built-in capabilities along with a simple storage mechanism to track request counts. The following sections will guide you through the implementation process, covering key concepts and best practices.

Understanding Rate Limiting

Rate limiting can be implemented in various ways, including:

IP-based limiting: Restricting the number of requests from a specific IP address.
User-based limiting: Limiting requests based on user authentication.
Endpoint-based limiting: Applying different limits to different API endpoints.

In this tutorial, we will focus on IP-based limiting, which is common for public APIs.

Implementation Steps

Step 1: Define Rate Limiter Class

We will create a RateLimiter class that will handle the logic for counting requests and enforcing limits.

<?php

class RateLimiter {
    private $limit;
    private $timeFrame;
    private $storage;

    public function __construct($limit, $timeFrame, $storage) {
        $this->limit = $limit;
        $this->timeFrame = $timeFrame;
        $this->storage = $storage;
    }

    public function isAllowed($key) {
        $currentTime = time();
        $this->cleanup($key, $currentTime);

        if (!isset($this->storage[$key])) {
            $this->storage[$key] = ['count' => 0, 'firstRequestTime' => $currentTime];
        }

        if ($this->storage[$key]['count'] < $this->limit) {
            $this->storage[$key]['count']++;
            return true;
        }

        return false;
    }

    private function cleanup($key, $currentTime) {
        if (isset($this->storage[$key]) && ($currentTime - $this->storage[$key]['firstRequestTime']) > $this->timeFrame) {
            unset($this->storage[$key]);
        }
    }
}

Step 2: Using the Rate Limiter

Next, we will create an instance of the RateLimiter and use it in a hypothetical API endpoint.

<?php

// Simulated storage (in-memory for simplicity)
$storage = [];

// Create a rate limiter that allows 5 requests per minute
$rateLimiter = new RateLimiter(5, 60, $storage);

// Simulated request handling
function handleRequest($ip) {
    global $rateLimiter;

    if ($rateLimiter->isAllowed($ip)) {
        return "Request successful!";
    } else {
        return "Rate limit exceeded. Try again later.";
    }
}

// Example usage
$ipAddress = $_SERVER['REMOTE_ADDR']; // Get the user's IP address
$response = handleRequest($ipAddress);
echo $response;

Step 3: Testing the Rate Limiter

To test the rate limiter, you can simulate multiple requests from the same IP address. You should observe that after the limit is reached, subsequent requests receive a "Rate limit exceeded" message.

Step 4: Enhancements and Best Practices

Persistent Storage: For production use, consider using a more persistent storage mechanism like Redis or a database to store request counts across server restarts.

Dynamic Limits: Implement dynamic limits based on user roles or subscription levels.

Response Headers: Include rate limit information in response headers for better client awareness. For example:

header("X-RateLimit-Limit: 5");
header("X-RateLimit-Remaining: " . (5 - $rateLimiter->getRemaining($ipAddress)));
header("X-RateLimit-Reset: " . $rateLimiter->getResetTime($ipAddress));

Logging: Log rate-limited requests for monitoring and analysis.

Rate Limiter Class with Persistent Storage Example

Below is an enhanced version of the RateLimiter class that uses a simple file-based storage mechanism.

<?php

class FileStorage {
    private $filePath;

    public function __construct($filePath) {
        $this->filePath = $filePath;
    }

    public function get($key) {
        if (!file_exists($this->filePath)) {
            return null;
        }
        $data = json_decode(file_get_contents($this->filePath), true);
        return $data[$key] ?? null;
    }

    public function set($key, $value) {
        $data = file_exists($this->filePath) ? json_decode(file_get_contents($this->filePath), true) : [];
        $data[$key] = $value;
        file_put_contents($this->filePath, json_encode($data));
    }

    public function delete($key) {
        if (file_exists($this->filePath)) {
            $data = json_decode(file_get_contents($this->filePath), true);
            unset($data[$key]);
            file_put_contents($this->filePath, json_encode($data));
        }
    }
}

// Usage
$storage = new FileStorage('rate_limit_storage.json');
$rateLimiter = new RateLimiter(5, 60, $storage);

Conclusion

Implementing a custom rate limiter in PHP is a straightforward process that can significantly enhance the security and reliability of your web applications. By following the steps outlined in this tutorial, you can create a robust solution tailored to your specific needs.