Suggest an editImprove this articleRefine the answer for “What is rate limiting?”. Your changes go to moderation before they’re published.Approval requiredContentWhat you’re changing🇺🇸EN🇺🇦UAPreviewTitle (EN)Short answer (EN)**Rate limiting** is a defense mechanism that limits the number of requests a user, IP address or application can send within a given time period. **Key point:** rate limiting alone will not stop a large DDoS attack, so it is usually used together with a firewall, WAF and anti-DDoS services.Shown above the full answer for quick recall.Answer (EN)Image**Rate limiting** is a defense mechanism that **limits the number of requests** a user, IP address or application can send **within a given time period**. In simple terms: *rate limiting stops a single source from hitting a service "too often."* --- ## Why rate limiting is needed Without limits: - a service is easy to overload; - brute force and DDoS attacks become possible; - an attacker can "spam" an API or a login form. Rate limiting is needed to: - protect a service from overload; - reduce the risk of attacks; - ensure stable operation for all users. --- ## How rate limiting works The system counts requests from a source (for example, an IP) and applies a rule, such as: - no more than **100 requests per minute**; - no more than **5 login attempts in 10 minutes**. If the limit is exceeded: - requests are temporarily blocked; - an error is returned (for example, HTTP 429); - sometimes a delay is introduced. Limits can be applied to: - an IP address; - a user; - an API key; - a session. --- ## Where rate limiting is used - websites; - APIs; - login forms; - authorization services; - L7 DDoS protection. --- ## Which attacks it helps prevent Rate limiting effectively protects against: - **brute force** (password guessing); - **credential stuffing**; - **HTTP flood**; - API abuse. It is one of the **basic but very important L7 defense measures**. --- ## Types of rate limiting (simplified) - **A hard limit**, where requests are blocked once the limit is exceeded - **A soft limit**, where requests are slowed down - **Adaptive**, where limits change depending on behavior --- ## Limitations of rate limiting It is important to understand: - on its own, it will not stop a large DDoS attack; - it requires the limits to be configured correctly; - it can get in the way of legitimate users if misconfigured. It is usually used **together with a firewall, WAF and anti-DDoS**.For the reviewerNote to the moderator (optional)Visible only to the moderator. Helps review go faster.