---
title: "Using mod_qos and mod_reqtimeout to mitigate Slowloris attacks"
source: "https://docs.nexcess.com/hosting/security/using-mod_qos-and-mod_reqtimeout-to-mitigate-slowloris-attacks/"
description: "Protect your Apache server from Slowloris attacks. Learn how to install and configure mod_qos, set up connection limits, and integrate with CSF."
vertical: "Hosting"
date: "2025-06-03"
last_modified: "2026-06-30"
---

# Using mod_qos and mod_reqtimeout to mitigate Slowloris attacks

**mod\_qos** and **mod\_reqtimeout** are two Apache modules that help mitigate **Slowloris-style attacks** (a type of Denial of Service (DoS) attack that targets web servers by opening many simultaneous connections and keeping them alive as long as possible, thereby exhausting the server’s resources) by controlling how long and how much data clients are allowed to send. Unlike the older and unmaintained mod\_evasive, mod\_qos is still actively developed and provides advanced traffic handling features.

This guide explains how to install and configure mod\_qos, outlines the compatibility requirements, and demonstrates how to integrate it with CSF for enhanced protection.

## What Is mod\_qos?

> *mod\_qos is a quality of service module for Apache that implements control mechanisms providing different priority levels to HTTP requests.”*

In practical terms, it lets you manage how many connections a client can open, how fast they need to send data, and much more. This makes it especially useful for mitigating denial-of-service attacks like Slowloris.

## Before You Begin

Make sure your system meets the following prerequisites:

- **Apache 2.2 or 2.4**
- **MPM worker** or **MPM event** (preferred)
- Root shell access
- `apxs` installed (`httpd-devel` package)

NoteWhile mod\_qos works on Apache 2.4, some directives like QS\_MinSrvDataRate and QS\_Srv\* may not function as expected. The developer recommends Apache 2.2 with MPM worker for best results.

## Installation

### Download and Compile mod\_qos

**For EA3 (EasyApache 3)**

```
mkdir -p /usr/local/apache/custom-modules<br></br>cd /usr/local/apache/custom-modules<br></br>curl -L https://sourceforge.net/projects/mod-qos/files/mod_qos-11.56.tar.gz/download -o mod_qos-11.56.tar.gz<br></br>tar -xzf mod_qos-11.56.tar.gz<br></br>/usr/local/apache/bin/apxs -aic mod_qos-11.56/apache2/mod_qos.c<br></br>/usr/local/cpanel/bin/apache_conf_distiller --update<br></br>/scripts/rebuildhttpdconf<br></br>service httpd restart
```

To ensure persistence across EasyApache runs:

```
echo "/usr/local/apache/bin/apxs -aic /usr/local/apache/custom-modules/mod_qos-11.56/apache2/mod_qos.c && /usr/local/cpanel/bin/apache_conf_distiller --update" >> /scripts/after_apache_make_install
```

**For EA4 (EasyApache 4)**

```
cd /usr/local/src/<br></br>curl -L https://sourceforge.net/projects/mod-qos/files/mod_qos-11.56.tar.gz/download -o mod_qos-11.56.tar.gz<br></br>tar -xzf mod_qos-11.56.tar.gz<br></br>/usr/local/apache/bin/apxs -aic mod_qos-11.56/apache2/mod_qos.c
```

After installation, the module should be loaded in:

```
/etc/apache2/conf.modules.d/mod_qos.conf
```

### Optional: Enable GeoIP Support

`mod_qos` supports geographic prioritization using GeoIP. To set it up:

```
cd /usr/local/apache/conf<br></br>mkdir geoIP<br></br>cd geoIP<br></br>funzip <(curl http://geolite.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip) > GeoIPCountryWhois.csv
```

This file can be referenced in advanced mod\_qos rules for geo-based control.

### Integrate mod\_qos with CSF

CSF (ConfigServer Security & Firewall) can work with mod\_qos to block repeated offenders.

Edit `/etc/csf/csf.conf`:

```
LF_QOS = "5"<br></br>LF_QOS_PERM = "1"
```

- **LF\_QOS = “5”** allows 5 violations before blocking.
- **LF\_QOS\_PERM = “1”** blocks the IP permanently.  
    To set a temporary block (e.g., 1 hour), use:

```
LF_QOS_PERM = "3600"
```

Restart CSF and LFD to apply changes:

```
/etc/init.d/csf restart<br></br>/etc/init.d/lfd restart
```

### Where to configure mod\_qos

All mod\_qos rules should be wrapped in an `<IfModule mod_qos.c>...</IfModule>` block and ideally placed inside:

```
/usr/local/apache/conf/includes/pre_virtualhost_global.conf
```

After editing this file, rebuild and restart Apache:

```
/scripts/rebuildhttpdconf<br></br>service httpd restart
```

#### Example mod\_qos configuration template

Here’s a basic configuration template to get started:

```
<IfModule mod_qos.c><br></br>  QS_ClientEntries 100<br></br>  QS_SrvMaxConn 100<br></br>  QS_SrvMaxConnClose 5<br></br>  QS_LocRequestLimitMatch "^/login" 5<br></br>  QS_LocRequestPerSecLimitMatch "^/api/" 10<br></br>  QS_SrvRequestRate 300<br></br></IfModule>
```

This example limits:

- Concurrent clients and connections
- Requests per second to `/api/`
- Access to `/login` to avoid brute-force

### Final Notes

- Avoid installing mod\_qos without a specific use case. This powerful module can also interfere with legitimate traffic if misconfigured.
- For full documentation, see the [mod\_qos main page on SourceForge](https://sourceforge.net/projects/mod-qos/).

## Summary

`mod_qos` is a modern, flexible alternative to `mod_evasive` for mitigating Slowloris and similar attacks on Apache servers. Combined with CSF and optional GeoIP support, it offers advanced traffic control features. Installation involves compiling the module manually, adding configurations, and integrating with your firewall. Always test changes in a controlled environment before deploying to production.