An HTTP tarpit (also known as a “tarpit response” or “slowloris defense”) intentionally delays server responses to exhaust an attacker’s connection pool, memory, and threads without consuming your own outgoing network bandwidth. Instead of sending a large file like a video, the server sends extremely small chunks of data at long intervals to keep the bot’s socket open indefinitely.<\/p>\n\n\n\n
Infrastructure Risk & Prerequisites<\/p>\n\n\n\n
Do not apply tarpitting globally across your entire site. Apply it strictly to flagged bot IP addresses or isolated malicious routes (e.g., 1.Identify and Isolate Bot Traffic:<\/strong>Step 1.<\/p>\n\n\n\n Configure your Web Application Firewall (WAF) or Reverse Proxy (e.g., Nginx, Cloudflare) to flag requests matching bot behavior\u2014such as missing standard headers, high-frequency POST requests, or known bad user agents.<\/p>\n\n\n\n Verification:<\/em> Check your access logs to ensure legitimate user IPs are not triggering the bot rule.<\/p>\n\n\n\n 2.Configure Slow Response Rate Limits in Nginx:<\/strong>Step 2.<\/p>\n\n\n\n Use Nginx’s Nginx<\/p>\n\n\n\n Verification:<\/em> Run 3.Implement Application-Level Sleep Loops (Node.js \/ Express):<\/strong>Step 3.<\/p>\n\n\n\n If implementing directly in your backend application, stream space characters or white noise characters back to the client inside an interval loop before closing the connection.<\/p>\n\n\n\n JavaScript<\/p>\n\n\n\n Verification:<\/em> Monitor server process CPU and memory usage using \/api\/register<\/code>). If applied indiscriminately, genuine users with slow connections will experience server timeouts, and your web server may run out of worker processes if worker limits are configured too low.<\/p>\n\n\n\nImplementation Strategy<\/h2>\n\n\n\n
limit_rate<\/code> directive on the target membership endpoint to throttle response transmission to as low as 1 byte per second.<\/p>\n\n\n\nlocation = \/api\/register {\n # Restrict transmission speed for flagged requests\n limit_rate 1; \n \n # Hold response headers open\n add_header Content-Type \"text\/plain\";\n return 200 \"Processing registration request...\";\n}\n<\/code><\/pre>\n\n\n\ncurl -i -X POST [https:\/\/yourdomain.com\/api\/register](https:\/\/yourdomain.com\/api\/register)<\/code> from a command line. The response should pause indefinitely after receiving the initial bytes without closing the connection.<\/p>\n\n\n\napp.post('\/api\/register', (req, res) => {\n if (isBotRequest(req)) {\n res.setHeader('Content-Type', 'text\/plain');\n \n \/\/ Send 1 character every 5 seconds to hold the socket open\n const tarpitInterval = setInterval(() => {\n res.write(' ');\n }, 5000);\n\n \/\/ Terminate connection after 5 minutes to prevent memory leaks\n req.on('close', () => clearInterval(tarpitInterval));\n setTimeout(() => {\n clearInterval(tarpitInterval);\n res.end();\n }, 300000);\n return;\n }\n \n \/\/ Process legitimate user registration...\n});\n<\/code><\/pre>\n\n\n\ntop<\/code> or process monitoring tools during a test run to confirm resource consumption stays near zero while maintaining open connections.<\/p>\n\n\n\nWhen to Use Tarpitting vs. Direct Blocking<\/h2>\n\n\n\n