Restricting how often something can be requested.
WHAT IT DOES
Counts requests from an address to a path over a period, and acts when a threshold is exceeded.
WHERE IT HELPS
Login pages, against credential stuffing Contact forms, against spam submissions Search, against resource-heavy repeated queries API endpoints
A SENSIBLE LOGIN RULE
A handful of requests to the login path per minute per address, then challenge or block for a period.
Legitimate users do not attempt to log in twenty times a minute. Automated attacks do.
CHOOSING THRESHOLDS
Generous enough that no legitimate user hits them, tight enough to stop automation.
Start generous and tighten if abuse continues.
THE FREE PLAN
Offers limited rate limiting. Check what is available on your plan.
WHAT IT PROTECTS
Your resources. Every blocked attempt is a request that never consumes an entry process on your account.
For a site repeatedly hitting resource limits because of login attacks, this is the fix.
TESTING
Confirm legitimate use still works before relying on it.
