An admin surface deserves its own rate limit

A login form is the highest-value endpoint on the site and is usually governed by the same limit as a product page.

limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
limit_req_zone $binary_remote_addr zone=admin:10m rate=60r/m;

location = /admin/login {
    limit_req zone=login burst=3 nodelay;
    limit_req_status 429;
}

# and behind a proxy, $binary_remote_addr is the PROXY.
# the zone key must be the forwarded address, and the
# proxy must be trusted for that to mean anything.

The proxy caveat is what makes a rate limit silently useless behind a CDN, because every request appears to come from one address — either the limit blocks everybody or it is set high enough to block nobody. Setting real_ip_header with a trusted proxy list is the prerequisite, and getting it wrong lets a client set their own apparent address.