Rate limiting
Why does a website block you for refreshing too much?
Demo 2 of 7Reel"Bakit ka bina-block ng website kapag paulit-ulit kang nagre-refresh?"
Try it
Tap Refresh as fast as you can and watch the count run out.
POST /api/lab/rate-limitReal server5 requests every 10 seconds, per visitor.
5
requests left in this window
The window starts with your first request
Responses
Nothing sent yet. Tap Refresh.
What just happened
The server keeps a count for each visitor. This one allows five requests in a ten-second window. The sixth gets 429 Too Many Requests, with a Retry-After header saying how many seconds to wait.
It isn't personal. The limit protects the server from scripts that hit it thousands of times a second, and it stops one heavy user from slowing the site down for everyone else.
The pixel me on the home page has a limit too. Poke him fast enough for long enough and you'll meet the same 429.
Where you've seen it
- Being told to wait after too many wrong passwords
- An app that says "Try again later" when you tap too fast
- A ticket site that stops loading while everyone refreshes at once