What is rate limiting?

Rate limiting is a defense mechanism that limits the number of requests a user, IP address or application can send within a given time period.

In simple terms: rate limiting stops a single source from hitting a service "too often."

---

#Why rate limiting is needed

Without limits:

• a service is easy to overload;
• brute force and DDoS attacks become possible;
• an attacker can "spam" an API or a login form.

Rate limiting is needed to:

• protect a service from overload;
• reduce the risk of attacks;
• ensure stable operation for all users.

---

#How rate limiting works

The system counts requests from a source (for example, an IP) and applies a rule, such as:

• no more than 100 requests per minute;
• no more than 5 login attempts in 10 minutes.

If the limit is exceeded:

• requests are temporarily blocked;
• an error is returned (for example, HTTP 429);
• sometimes a delay is introduced.

Limits can be applied to:

• an IP address;
• a user;
• an API key;
• a session.

---

#Where rate limiting is used

• websites;
• APIs;
• login forms;
• authorization services;
• L7 DDoS protection.

---

#Which attacks it helps prevent

Rate limiting effectively protects against:

• brute force (password guessing);
• credential stuffing;
• HTTP flood;
• API abuse.

It is one of the basic but very important L7 defense measures.

---

#Types of rate limiting (simplified)

• A hard limit, where requests are blocked once the limit is exceeded
• A soft limit, where requests are slowed down
• Adaptive, where limits change depending on behavior

---

#Limitations of rate limiting

It is important to understand:

• on its own, it will not stop a large DDoS attack;
• it requires the limits to be configured correctly;
• it can get in the way of legitimate users if misconfigured.

It is usually used together with a firewall, WAF and anti-DDoS.