quoting https://en.wikipedia.org/wiki/Slowloris_(computer_security) :

> Since Apache 2.2.15, Apache ships the module mod_reqtimeout as the
> official solution supported by the developers

From https://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html
default is header=20-40,MinRate=500 body=20,MinRate=500
which seem to be good default.