# rack/rack-attack

Rack middleware for blocking & throttling

Repository: https://github.com/rack/rack-attack
Canonical: https://ross.abutalabs.com/products/rack-attack
Language: Ruby
License: MIT
License Family: permissive
Topics: rack-attack, ruby, rack-middleware, rack
Last push: 2026-07-02T20:27:09+00:00

## Health v2 (maintenance only)
Score: 68/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 90, release rhythm 20, longevity 100
- inputs: {"age_days": 5149, "days_push": 62, "days_rel": 323, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 5763, forks 345 (observed 2026-08-28T04:09:29.343654+00:00)

## What it is
Rack::Attack is Rack middleware for protecting Ruby and Rails web applications from abusive clients. It lets you define rules to allow, blocklist, safelist, and throttle requests based on request properties.

## Use cases
- throttle requests per IP in a Rails app
- block abusive clients from my API
- rate limit login endpoints to prevent brute force
- safelist office IPs while blocking others
- ban IPs after repeated failed requests with fail2ban-style rules
- add RateLimit headers to API responses

## When to choose
- you run a Rack-based app (Rails, Sinatra) and need request throttling or blocking
- you want simple, configurable middleware-level abuse protection without extra infrastructure
- you need fail2ban/allow2ban-style dynamic banning at the app layer

## When to avoid
- you need network-level or edge protection (use a WAF, CDN, or load balancer instead)
- your app is not Ruby/Rack-based
- you need distributed rate limiting across many datacenters with strict guarantees beyond a shared cache store

## Facets
- artifact type: library
- maturity: stable
- function: middleware, rate-limiting, security, web-framework
- domain: security, web-development, backend
- platform: ruby, self-hosted
- tags: rack, rails, throttling, blocklist, safelist, abuse-protection, rate-limiting, web-server

## Member repositories
- rack/rack-attack (main) score 68

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:29.343654+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:52:57.247278+00:00, confidence not recorded.
  - readme: https://github.com/rack/rack-attack (fetched 2026-08-28T04:09:29.343654+00:00, sha e949fed47537)
- Data as of 2026-08-30T08:39:29.467469+00:00.