×
Ranked #1 for value density
First premium report free
LLM-optimized PDFs
How to Implement Rate Limiting
Protect your application from excessive requests.
Rate limiting is essential for protecting your site from brute‑force attacks, credential stuffing, and denial‑of‑service. This guide covers best practices for implementing rate limiting on login endpoints, APIs, and other sensitive routes, including code examples for popular frameworks.
150+
Security checks
16
Categories covered
30s
Scan duration
100%
Detection coverage
Key Findings
No Rate Limiting on Login high
No API Rate Limiting medium
Missing CAPTCHA After Failures medium
Unlimited Password Reset high
Why Rate Limiting is Essential
Rate limiting controls the number of requests a client can make in a given time. Without it, attackers can: brute‑force passwords by trying millions of combinations, scrape your content at high speed, exhaust server resources with DDoS attacks, and abuse API endpoints to cause financial damage (e.g., SMS bombing). Rate limiting is a cheap and effective defense.
How to Implement Rate Limiting – Code Examples
Rate limiting can be implemented at the application level or via web server modules. Here are examples for common stacks:
- Node.js (Express): `const rateLimit = require("express-rate-limit"); const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }); app.use("/login", limiter);`
- PHP (Laravel): `use Illuminate\Cache\RateLimiting\Limit; RateLimiter::for("login", fn () => Limit::perMinute(5));`
- Python (Django): `from django_ratelimit.decorators import ratelimit; @ratelimit(key="ip", rate="5/m")`
- Nginx: `limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;`
- Apache: `mod_evasive` or `mod_ratelimit`.
- Cloudflare: Use the "Rate Limiting" rule in the dashboard.
Best Practices for Rate Limiting
Define different limits per endpoint: login endpoints should have a stricter limit (e.g., 5‑10 attempts per minute) than public APIs (e.g., 100‑1000 requests per minute). Use IP‑based limiting for anonymous users and user‑ID‑based limiting for authenticated users. Return a `429 Too Many Requests` status code with a `Retry-After` header. Implement exponential backoff or CAPTCHA after repeated failures.
The Problem
Without rate limiting, your site is vulnerable to attacks
- Brute‑force password attacks
- Credential stuffing from data breaches
- API abuse and financial fraud
- Resource exhaustion (DDoS)
- Content scraping
OffURL Solution
OffURL detects missing rate limiting and provides fix steps
- Test login endpoints for rate limiting
- Test password reset endpoints
- Test API endpoints for throttling
- Provide code examples for your stack
- Generate an LLM‑ready PDF for AI‑assisted implementation
Key Features
Rate limiting test
We send a burst of requests to detect if rate limiting is in place.
Code examples
Get ready‑to‑use code for Express, Laravel, Django, Nginx, and more.
LLM‑ready PDF
Get a report formatted for ingestion into your AI assistant.
Actionable fixes
Receive specific recommendations for your stack.
How do I test if rate limiting is working on my site?
Run an OffURL audit. Our scanner sends a series of rapid requests to your login and API endpoints. If we receive a `429 Too Many Requests` status code or similar, rate limiting is active. If all requests succeed, your endpoints are unprotected and you should implement rate limiting immediately.
Frequently Asked Questions
What is OffURL and how does it work?
OffURL is a comprehensive website security and performance audit tool. It scans your site for 150+ checks including SSL, security headers, malware, XSS, SQL injection, email security, and more.
Is the security audit really free?
Yes. Your first security report is completely free and includes premium features like detailed findings, fix steps, and the full 150+ checks.
How can I use AI to fix security issues?
Download the premium PDF report and paste it into your preferred LLM (Claude, ChatGPT, Gemini, Cursor) with a prompt asking for specific fixes for your framework.
How long does the security audit take?
Most audits complete in 10‑30 seconds. The scan includes DNS lookups, SSL analysis, HTTP requests, port scanning, and vulnerability tests.
Do I need to create an account?
No. OffURL works without registration. Your first audit is free with premium features included.
What vulnerabilities can OffURL detect?
OffURL detects XSS, SQL Injection, NoSQL Injection, LDAP Injection, XXE, SSRF, SSTI, Code Injection, Command Injection, Open Redirect, Path Traversal, LFI, RFI, CRLF Injection, Parameter Pollution, and CORS Misconfiguration.