--- title: "A rate limit costs US$0 in NGINX, US$12 in AWS WAF and US$1,825 on Kong Konnect" summary: "Four places to put an API rate limit, priced for 1 crore requests a month, and the status code a client should get when it trips. List prices as of September 2026." url: https://www.thetechbag.com/blog/api-rate-limiting-websites format: Note desk: "Cloud & DevOps" published: 2025-11-18 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["API","rate limiting","NGINX","AWS WAF","Cloudflare","Kong Konnect","HTTP 429","OWASP","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/api-rate-limiting-websites.png --- # A rate limit costs US$0 in NGINX, US$12 in AWS WAF and US$1,825 on Kong Konnect *Four places to put an API rate limit, priced for 1 crore requests a month, and the status code a client should get when it trips. List prices as of September 2026.* Note · Cloud & DevOps · By TechBag · Published 2025-11-18 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/api-rate-limiting-websites Putting a rate limit in front of an API that serves 1 crore requests a month costs anything from nothing to US$1,825 a month, and the bill depends on where the limit sits, not on the algorithm. NGINX’s open-source `limit_req` module does it inside the web server for no licence fee.[1] AWS WAF charges US$1 a month for the rule plus US$0.60 per million requests inspected.[2] Kong Konnect Plus meters the whole gateway at US$200 for every million requests past the first.[3] The 2023 version of this piece explained token buckets and sliding windows, and quoted a claim that APIs are “300 times more likely to be attacked than websites”. We could not trace that figure to a study and have dropped it. The buyer’s question is narrower: which layer should hold the limit, what it costs there, and what the client should be told when it trips. ## Where the limit sits sets the bill **Figure: The limit itself is nearly free; a managed gateway that meters every request is not** *Monthly list cost to rate-limit 1 crore API requests, US$, as of September 2026* NGINX open source limit_req, in the web server US$0 AWS WAF 1 web ACL, 1 rule, 10M requests US$12 Cloudflare Pro about; 2 rules, by IP only US$20 Cloudflare Business about; 5 rules US$200 Kong Konnect Plus 1M requests included US$1,825 | | Value (US$) | | --- | --- | | NGINX open source | 0 | | AWS WAF | 12 | | Cloudflare Pro | 20 | | Cloudflare Business | 200 | | Kong Konnect Plus | 1,825 | Source: AWS WAF and Kong pricing pages; Cloudflare plan prices from TechBag's Cloudflare Application Security page; NGINX documentation · as of 30 September 2026 · NGINX excludes the servers you run it on; Kong is the whole managed gateway, capped at 1 crore requests on Plus; Cloudflare is a flat per-site plan TechBag countHow we priced 1 crore requests AWS WAF: US$5 for the web ACL, US$1 for one rule, and 10 × US$0.60 for ten million requests, so US$12.[2] Kong Konnect Plus: US$25 for a control plane with one million requests included, plus 9 × US$200, so US$1,825; ten million a month is also the most Plus allows.[3] Cloudflare charges per site, not per request.[5] The cheap options have a catch. Cloudflare’s plans include one rate-limiting rule on Free, two on Pro and five on Business, and below Enterprise they count by IP address only; counting by header, cookie, path or a JSON body field, which is how you limit one customer’s API key, is the Enterprise “Advanced Rate Limiting” tier.[4] Our view: a per-IP limit stops a crude flood and does nothing about one key called from a hundred addresses. Count per key at the cheapest layer that can see the key, which is usually the gateway or the application, not the CDN’s free tier. ## Tell the client 429, not 503 RFC 6585, published in April 2012, defined `429 Too Many Requests` and lets the server add a `Retry-After` header saying how long to wait.[6] NGINX still answers a rate-limited request with 503 unless you set `limit_req_status`.[1] A 503 tells the client the server is down, and a well-written client retries, which is the opposite of what you want. GitHub is the pattern worth copying: 60 requests an hour unauthenticated, 5,000 with a personal token, 15,000 for an Enterprise Cloud organisation’s app, every limit returned in `x-ratelimit-limit`, `-remaining`, `-used` and `-reset` headers.[7] ## Rate is one limit of five OWASP renamed this risk between its 2019 and 2023 API security lists, from “Lack of Resources & Rate Limiting” to “Unrestricted Resource Consumption”.[8] The 2023 entry names execution timeouts, memory, operations per request, records per page and third-party spending limits. The last one is the Indian one: an OTP endpoint that sends an SMS on every call spends your money at whatever rate an attacker chooses, so cap the spend as well as the calls. **Buying in India.** Every price above is USD list. Bought direct on a card, an Indian company self-assesses 18% IGST under reverse charge; through a reseller it gets an INR invoice with 18% GST.[9] The regulation that bites is CERT-In’s Directions of 28 April 2022: denial-of-service attacks are on the list to report within six hours, and logs must be kept for 180 days, so a limit that logs what it rejected is evidence you will need.[10] The DPDP Rules, notified on 13 November 2025, bring the security-safeguard duty into force on 13 May 2027; an API that lets a scraper page through customer records unthrottled is the failure that duty describes.[11] How we did this Figures as of 30 September 2026 Prices are list prices on the vendors’ public pages, USD, before tax. The workload is one API at 1 crore requests a month with one rate rule; AWS WAF prices a rate-based rule as an ordinary rule. Cloudflare’s plan prices are the approximate per-site figures on TechBag’s intel page as it stood on 30 September 2026. Server, egress and engineering time are excluded. No vendor was contacted. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [NGINX, ngx_http_limit_req_module (leaky bucket; limit_req_status defaults to 503)](https://nginx.org/en/docs/http/ngx_http_limit_req_module.html) — undated page 2. [AWS WAF pricing (US$5 a web ACL, US$1 a rule, US$0.60 per million requests)](https://aws.amazon.com/waf/pricing/) — undated page 3. [Kong pricing, Konnect Plus (US$25 a control plane, 1M requests included, US$200 per extra million, 10M cap)](https://konghq.com/pricing) — undated page 4. [Cloudflare, Rate limiting rules: availability by plan](https://developers.cloudflare.com/waf/rate-limiting-rules/) — updated 25 August 2026 5. [TechBag, Cloudflare Application Security intel page (Pro about US$20, Business about US$200 a site a month; INR and GST invoicing)](https://www.thetechbag.com/cloudflare/cloudflare-application-security) — version of 30 September 2026 6. [IETF, RFC 6585, Additional HTTP Status Codes (section 4, 429)](https://www.rfc-editor.org/rfc/rfc6585.html) — April 2012 7. [GitHub Docs, Rate limits for the REST API](https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api) — undated page 8. [OWASP API Security, API4:2023 Unrestricted Resource Consumption](https://api-security.owasp.org/editions/2023/en/0xa4-unrestricted-resource-consumption) — 2023 edition 9. [TechBag, Pipedrive Campaigns intel page (USD billing without a GST invoice means 18% IGST under reverse charge)](https://www.thetechbag.com/pipedrive/pipedrive-campaigns) — version of 30 September 2026 10. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, 180-day logs)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 11. [MeitY, Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025](https://www.meity.gov.in/data-protection-framework) — 13 November 2025 Related on TechBag: the [Kong Konnect page](https://www.thetechbag.com/kong/kong-konnect) for the gateway rate card, and the [developer tools guide](https://www.thetechbag.com/browse/devops/developer-tools) for where API gateways sit beside the rest of the toolchain. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Kong Konnect intel page](https://www.thetechbag.com/kong/kong-konnect) — the published gateway rate card and the Plus request cap - [Cloudflare Application Security intel page](https://www.thetechbag.com/cloudflare/cloudflare-application-security) — WAF, bot and API protection on one edge, invoiced in INR with GST - [Developer tools guide](https://www.thetechbag.com/browse/devops/developer-tools) — where API gateways sit beside the rest of the toolchain