Rate limiting is a control that caps how many requests one client may send during a defined window of time on that service.
Once the cap is reached, the service delays or refuses more requests from that client until the window allows them again.
How it works
Designers pick a number that fits human use of a page and the capacity behind it.
A login or a checkout usually deserves a tighter cap than a public article, because rapid repetition there is less like reading.
The counter may follow an address, an account, or a session, and the window may be fixed or sliding.
The control reduces bursts and makes bulk automation less profitable, but a request under the cap can still be abusive.
Concrete examples
- A sign in form allows a few attempts each minute and then tells the client to wait.
- An integration key may call an inventory route a stated number of times each hour.
- A product page slows a client that reloads the same item dozens of times in seconds.
Protective measures
- Choose caps from real customer traffic so ordinary peaks are not treated as abuse.
- Return a clear wait signal so honest programs can slow down instead of hammering retries.
- Count by account and by address together so a pool of addresses does not erase the limit.
- Review routes that hit the cap often and compare those bursts with your real sales calendar.
How CDPCaptcha helps
Proof of work complements a request cap by asking each client for computation instead of only counting how often it calls.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.
Related articles
What is scraping? explains program copying that request caps are often used to slow down.
What is server overload? explains what happens when demand exceeds capacity, which caps help prevent.
What are scalper bots? explains retail programs that race limited stock and are a reason to cap checkout attempts.