Rate Limiting

Quick Introduction

Rate Limiting is a single PHP idea you'll use in almost every backend project.

In this lesson you learn only rate limiting — not five topics at once. By the end you can write a small working example and explain it in an interview.

We connect each lesson to our course projects: Login System, Blog CMS, REST API, Inventory, Employee Management, and E-Commerce Backend.

Business Problem

You're building the REST API. After a user signs in, you need rate limiting working correctly before storing data or showing a dashboard.

Without understanding Rate Limiting, the team ships bugs: wrong totals, broken sessions, or type errors that only appear in production. This lesson fixes that with one clear pattern you can copy into your project today.

Core Concept

• Rate Limiting is one focused idea — learn it before mixing with other PHP topics.
• Use it in PHP 8.3+ with declare(strict_types=1); at the top of every file.
• Our course project (REST API) uses rate limiting in real handlers.
• Run small scripts with php file.php after each change — don't just read.
• Interviewers ask for a one-minute explanation plus a tiny code sample.

Syntax

Core syntax for Rate Limiting. Every keyword below appears in production PHP — Laravel and Symfony use the same primitives under the hood.

declare(strict_types=1);

Keywords: declare · strict_types · namespace

Step-by-Step Example

Run this script locally. Change one value, run again, and watch what changes.

<?php
declare(strict_types=1);

$redis = new Redis();
$redis->connect(getenv('REDIS_HOST') ?: '127.0.0.1', 6379);

$clientIp = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
$key      = "rate:{$clientIp}:" . floor(time() / 60);
$limit    = 100;

$count = (int)$redis->incr($key);
if ($count === 1) {
    $redis->expire($key, 60);
}

if ($count > $limit) {
    header('Retry-After: 60');
    http_response_code(429);
    echo json_encode(['error' => 'Rate limit exceeded', 'limit' => $limit]);
    exit;
}

header("X-RateLimit-Remaining: " . max(0, $limit - $count));
echo json_encode(['ok' => true]);

Line by line

1. — part of the rate limiting example; run the file to see the result.
2. declare(strict_types=1); — turns on strict type checking for this file.
3. $redis = new Redis(); — part of the rate limiting example; run the file to see the result.
4. $redis->connect(getenv('REDIS_HOST') ?: '127.0.0.1', 6379); — part of the rate limiting example; run the file to see the result.
5. $clientIp = $_SERVER['REMOTE_ADDR'] ?? 'unknown'; — part of the rate limiting example; run the file to see the result.

Authenticated

Real-World Example

In the REST API, rate limiting appears in a single request handler — not spread across ten files. Keep the example small, test it with php, then paste the pattern into your project branch.

<?php
declare(strict_types=1);

// TODO: Rate Limiting exercise for REST API