nginx limit_req delays bursting requests unless nodelay is set, changing latency rather than rejection

The module implements a leaky bucket. With a burst value alone, excess requests up to that count are queued and released at the configured rate, so clients experience growing latency instead of errors, which can look like a slow backend. Adding nodelay serves them immediately and rejects only what exceeds the burst. A delay parameter splits the difference.

Two configuration details are easy to miss. Rejections return 503 by default, which is the wrong status for a rate limit and pollutes error dashboards; set the status to 429 explicitly. And zone sizing is finite: the documentation notes that a one megabyte zone holds about sixteen thousand states, and when the zone fills, nginx begins rejecting requests and logs a warning.