---
title: "Installing mod_reqtimeout"
source: "https://docs.nexcess.com/hosting/server-administration/linux/apache-web-server/installing-mod-reqtimeout/"
description: "Defend Apache vs Slowloris with `mod_reqtimeout`. Guide: install on EA3/EA4 & set `RequestReadTimeout` for header/body to drop slow attacks."
vertical: "Hosting"
date: "2025-06-04"
last_modified: "2026-06-30"
---

# Installing mod_reqtimeout

mod\_reqtimeout is an Apache module that helps defend against Slowloris (aka Slow DoS) attacks by setting timeouts for reading client request headers and bodies. This prevents malicious connections from monopolizing server threads by sending data very slowly.

This module is a lightweight and effective addition to your server’s Apache stack and works well in tandem with other mitigation tools like mod\_qos or firewall-level protections.

#### Installing mod\_reqtimeout

##### EasyApache 3 (EA3)

NoteEA3 is legacy and not recommended for new deployments. If you’re still on EA3, be cautious and back up before proceeding

##### Step 1: Take a Pre-EA Backup

Run the following to backup relevant Apache and PHP configuration files before making changes:

```
USR=LWUSER.$(date +%s);FILE=/root/preEA.$USR;LOC=/usr/local;CONF=$LOC/apache/conf;INI=$LOC/lib/php.ini;H=urrent;cp $CONF/httpd.conf{,.bak.$USR}; cp $CONF/php.conf{,.bak.$USR}; cp $INI{,.bak.$USR}; touch $FILE; cat > $FILE <(echo -e "n--C$H Handler--n"; $LOC/cpanel/bin/rebuild_phpconf --c$H; if [ -x /usr/bin/php4 ] ;then echo -e "n--PHP 4 Version--n" ; php4 -v 2>&1;  echo -e "n--PHP 4 Modules--n"; php4 -m 2>&1 ;fi;if [ -x /usr/bin/php5 ] ;then echo -e "n--PHP 5 Version--n";  php5 -v 2>&1 ; echo -e "n--PHP 5 Modules--n"; php5 -m 2>&1;fi ;echo -e "n--Apache Version--n" ;$LOC/apache/bin/httpd -V;  echo -e "n--Apache Modules--n";$LOC/apache/bin/httpd -l ; echo -e "nn--Date Created: $(date +%c)--";echo -e "n--Configuration files--n" ; echo "httpd.conf: $CONF/httpd.conf.bak.$USR"; echo "php.conf: $CONF/php.conf.bak.$USR"; echo "php.ini: $INI.bak.$USR";) ; echo -e "nC$H php version: $( php -v 2>/dev/null | head -n1 | awk '{print $2}' )nC$H Apache version: $( /usr/sbin/httpd -v | head -n1 | cut -d "/" -f2 | cut -d " " -f1 )nPreEA configuration stored in n$FILE" ; if [[ $( php -m 2>/dev/null | egrep -ic "(memcache(d)?|(i)?magick(wand)?|ffmpeg|apc|eaccelerator|xcache)$" ) -gt 0 ]]; then echo -e "e[1;31m---The following module(s) appear to be c$H ly installed---n$( php -m 2>/dev/null | egrep -io "(memcache(d)?|(i)?magick(wand)?|ffmpeg|apc|eaccelerator|xcache)$" )nUSRn=jfield.$(date +%s);FILE=/root/preEA.$USR;LOC=/usr/local;CONF=$LOC/apache/conf;INI---These will need to be reinstalled manually or otherwise compensated for after the EasyApache is complete---e[0m"; fi
```

##### Step 2: Add the Custom Module

```
cd /var/cpanel/easy/apache/custom_opt_mods<br></br>wget https://documentation.cpanel.net/download/attachments/2435429/custom_opt_mod-reqtimeout.tgz?version=10 -O custom_opt_mod-reqtimeout.tgz<br></br>tar -xvf custom_opt_mod-reqtimeout.tgz<br></br>
```

You should now see `Mod_ReqTimeOut (Anti-SlowLoris)` in the **Exhaustive Options List** when running EasyApache.

TipAlways run EasyApache in a screen session to avoid issues if your SSH session drops.

---

### EasyApache 4 (EA4)

There are two installation options:

##### Option 1: Use WHM

1. Go to **WHM » Software » EasyApache 4**.
2. Click **Customize** for your current profile.
3. Navigate to **Apache Modules**.
4. Search for and enable **mod\_reqtimeout**.
5. Review and provision.

##### Option 2: Install via YUM

```
yum install ea-apache24-mod_reqtimeout
```

Once installed, the module will load automatically.

#### Configuration

To activate the module’s protections, you’ll need to define request timeout settings. Add the following block to your Apache include file:

**File:** `/etc/apache2/conf.d/includes/pre_main_global.conf` (EA4)  
or  
`/usr/local/apache/conf/includes/pre_main_global.conf` (EA3)

```
<IfModule mod_reqtimeout.c><br></br>  RequestReadTimeout header=20-40,MinRate=500 body=20-40,MinRate=500<br></br></IfModule>
```

This configuration means:

- Apache will allow 20 seconds for reading headers or bodies, increasing to 40 seconds depending on traffic rate.
- If the incoming data rate drops below 500 bytes/sec, the request is dropped.

After saving the configuration:

```
/scripts/rebuildhttpdconf<br></br>service httpd restart
```

IMPORTANT Always test your websites after applying changes to confirm they load and function correctly.

### Summary

mod\_reqtimeout is a simple but effective tool to defend Apache servers against Slowloris attacks. Whether you’re on EA3 or EA4, installation and configuration are straightforward—and this module works well in conjunction with mod\_qos, CSF, and other protective measures.