diff --git a/common/redis.js b/common/redis.js
new file mode 100644
index 000000000..de8d9eb0b
--- /dev/null
+++ b/common/redis.js
@@ -0,0 +1,37 @@
+/*!
+ * cnpmjs.org - common/redis.js
+ *
+ * Copyright(c) cnpmjs.org and other contributors.
+ * MIT Licensed
+ *
+ * Authors:
+ *  dead_horse <dead_horse@qq.com> (http://deadhorse.me)
+ */
+
+'use strict';
+
+/**
+ * Module dependencies.
+ */
+
+var config = require('../config');
+
+// close redis by set config.redis to `null` or `{}`
+if (!config.redis || !config.redis.host || !config.redis.port) {
+
+  var redis = require('redis');
+  var wrapper = require('co-redis');
+  var logger = require('./logger');
+
+  var _client = redis.createClient(config.redis);
+
+  _client.on('error', function (err) {
+    logger.error(err);
+  });
+
+  module.exports = wrapper(_client);
+
+} else {
+  console.warn('can not found')
+  module.exports = null;
+}
diff --git a/config/index.js b/config/index.js
index 2563ec980..0b00909f3 100644
--- a/config/index.js
+++ b/config/index.js
@@ -93,6 +93,15 @@ var config = {
   syncModel: 'none', // 'none', 'all', 'exist'
   syncConcurrency: 1,
   maxDependencies: 200, // max handle number of package.json `dependencies` property
+
+  limit: {
+    enable: false,
+    token: 'koa-limit:download',
+    limit: 1000,
+    interval: 1000 * 60 * 60 * 24,
+    writeList: [],
+    blackList: []
+  }
 };
 
 // load config/config.js, everything in config.js will cover the same key in index.js
diff --git a/middleware/limit.js b/middleware/limit.js
new file mode 100644
index 000000000..a7ae19afa
--- /dev/null
+++ b/middleware/limit.js
@@ -0,0 +1,35 @@
+/**!
+ * cnpmjs.org - middleware/limit.js
+ *
+ * Copyright(c) cnpmjs.org and other contributors.
+ * MIT Licensed
+ *
+ * Authors:
+ *  dead_horse <dead_horse@qq.com> (http://deadhorse.me)
+ */
+
+'use strict';
+
+/**
+ * Module dependencies.
+ */
+
+var config = require('../config');
+var limit = require('koa-limit');
+var store = require('../common/redis');
+
+var limitConfig = config.limit;
+
+if (!limitConfig.enable) {
+  module.exports = function *ignoreLimit(next) {
+    yield *next;
+  }
+} else {
+
+  if (!config.debug) {
+    limitConfig.store = store;
+  }
+
+  module.exports = limit(limitConfig);
+}
+
diff --git a/package.json b/package.json
index 8a83f8815..77e4dfc93 100644
--- a/package.json
+++ b/package.json
@@ -18,6 +18,7 @@
     "co": "3.0.4",
     "co-gather": "0.0.1",
     "co-read": "0.0.1",
+    "co-redis": "1.1.0",
     "co-write": "0.3.0",
     "debug": "0.7.4",
     "eventproxy": "0.3.0",
@@ -26,6 +27,7 @@
     "gravatar": "1.0.6",
     "humanize-number": "0.0.2",
     "koa": "0.5.1",
+    "koa-limit": "0.0.2",
     "koa-markdown": "0.0.3",
     "koa-middlewares": "0.0.9",
     "logfilestream": "0.1.0",
@@ -39,6 +41,7 @@
     "nodemailer": "0.6.1",
     "qn": "0.2.1",
     "ready": "0.1.1",
+    "redis": "0.10.1",
     "semver": "2.2.1",
     "thunkify-wrap": "0.0.5",
     "urllib": "0.5.10",
diff --git a/routes/registry.js b/routes/registry.js
index 8781d0911..eaf895a0e 100644
--- a/routes/registry.js
+++ b/routes/registry.js
@@ -16,6 +16,7 @@
  */
 
 var middlewares = require('koa-middlewares');
+var limit = require('../middleware/limit');
 var login = require('../middleware/login');
 var publishable = require('../middleware/publishable');
 var syncByInstall = require('../middleware/sync_by_install');
@@ -44,7 +45,8 @@ function routes(app) {
   app.put('/:name/sync', sync.sync);
   app.get('/:name/sync/log/:id', sync.getSyncLog);
 
-  app.get('/:name/download/:filename', mod.download);
+  // need limit by ip
+  app.get('/:name/download/:filename', limit, mod.download);
 
   // put tarball
   // https://registry.npmjs.org/cnpmjs.org/-/cnpmjs.org-0.0.0.tgz/-rev/1-c85bc65e8d2470cc4d82b8f40da65b8e