# express-rate-limit/express-rate-limit

Basic rate-limiting middleware for the Express web server

Repository: https://github.com/express-rate-limit/express-rate-limit
Canonical: https://ross.abutalabs.com/products/express-rate-limit
Homepage: https://npmjs.com/package/express-rate-limit
Language: TypeScript
License: MIT
License Family: permissive
Topics: api, rate-limiting, rest-api, security, web, express, nodejs, rate-limiter, express-js, express-middleware
Last push: 2026-08-26T18:28:11+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 96, longevity 100
- inputs: {"age_days": 4284, "days_push": 7, "days_rel": 29, "gap_med": 15.5, "n_releases_24m": 19}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3289, forks 257 (observed 2026-08-28T04:07:53.869768+00:00)

## What it is
A rate-limiting middleware library for the Express web server, written in TypeScript. It limits repeated requests per IP or key over configurable time windows, with pluggable external data stores and standard RateLimit headers.

## Use cases
- rate limit requests to a public express api
- protect password reset endpoints from brute force
- throttle login attempts per ip
- add RateLimit headers to express responses
- share rate limit counters across servers with redis
- return 429 when clients exceed a request quota

## When to choose
- you run an Express (or Express-compatible) Node.js API and need request throttling
- you want a small, well-maintained middleware with memory or external stores
- you need standard draft RateLimit headers for clients

## When to avoid
- you use a framework other than Express without compatibility
- you need distributed rate limiting without an external store like Redis
- you need advanced quota policies per user/API key beyond what the store plugins provide

## Facets
- artifact type: library
- maturity: stable
- function: rate-limiting, middleware, security, http-server
- domain: web-development, backend, security, apis
- platform: -
- tags: express, rate-limiter, brute-force-protection, typescript, nodejs

## Member repositories
- express-rate-limit/express-rate-limit (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:53.869768+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:43:12.655780+00:00, confidence not recorded.
  - readme: https://github.com/express-rate-limit/express-rate-limit (fetched 2026-08-28T04:07:53.869768+00:00, sha 3ed1ec8667ce)
  - registry_npm: https://registry.npmjs.org/express-rate-limit (fetched 2026-08-29T09:35:58.171515+00:00, sha 11da94dd98cb)
- Data as of 2026-08-30T08:39:29.467469+00:00.