# Add limit_req_zone in the nginx http {} context (not inside server {}):
limit_req_zone $binary_remote_addr zone=contact_form:10m rate=3r/m;

# Add this location inside the existing HTTPS server for dilibworld.com:
location = /api/contact {
    client_max_body_size 12k;
    limit_req zone=contact_form burst=5 nodelay;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto https;
    proxy_pass http://127.0.0.1:8091;
}

# If the project directory itself is the Nginx document root, deny backend code:
location ^~ /backend/ { return 404; }