Before you invest in rate limiting

The version of this that works is simpler than the version most people imagine. Before you spend anything on rate limiting, it is worth confirming a few things are already true.

Security is a maintenance habit rather than a purchase, which is why it drifts. Write the reasoning down alongside the decision, because the reasoning is what changes first.

Prerequisites

• You can describe the outcome you want in one sentence
• Someone owns it after the work is done
• Unlimited endpoints get abused eventually
• You have a way to tell whether it worked

Warning signs

Limit by account and by address. The reasoning matters more than the rule, because the rule has exceptions. If it only works because one person remembers to do something, it does not work yet.

Return a clear response instead of failing silently. This is the sort of thing that compounds, quietly, in both directions. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

What this looks like day to day

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about rate limiting before you move on:

• Someone can say what the current setup is without going to look
• Return a clear response instead of failing silently — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Pick the one that would hurt most if it failed, and start there.