What Is Rate Limiting?

Rate limiting is a control that caps how many requests a client may send to a service within a given time window — for example, one hundred API calls per minute or five login attempts per hour. Requests beyond the limit are rejected, delayed, or challenged. Rate limiting protects infrastructure from overload, keeps costs predictable, and slows down abusive automation.

How Rate Limiting Works

A rate limiter tracks request counts per client key — typically an IP address, API token, user account, or session — and enforces a budget using algorithms such as fixed windows, sliding windows, or token buckets that allow short bursts while capping sustained throughput. Limits can be layered: a generous global ceiling for infrastructure protection, tighter budgets on expensive endpoints, and strict per-account rules on authentication routes. Well-designed APIs communicate limits through response headers and 429 Too Many Requests status codes so legitimate clients can back off gracefully.

What Rate Limiting Protects Against

Against infrastructure abuse, rate limiting is highly effective: it blunts request floods, keeps scrapers from monopolizing capacity, and contains runaway clients caused by bugs rather than malice. On authentication endpoints it slows brute force attacks by limiting how fast passwords can be guessed from any one source.

The Limits of Rate Limiting

The control is only as good as the key it counts by. Attackers who distribute traffic across a botnet or rotate through residential proxies present thousands of fresh IP addresses, each comfortably under any per-IP budget. Credential stuffing campaigns pace themselves to stay below thresholds by design. Overly strict limits meanwhile punish legitimate users behind shared corporate or carrier-grade NAT addresses, where many real people share one IP. Rate limiting is therefore a volume control rather than an intent control: it decides how much traffic gets through without knowing who sent it. Distinguishing human visitors from distributed automation requires the complementary layer of per-request verification — the role bot detection services such as CaptchaFox play alongside rate limits, by checking browser environment and behavioral signals on the requests that limits alone would let through.