Getting started with rate limiting
Every audit we run turns up some version of this. A short on-ramp to rate limiting for teams who have not touched it before.
The cheapest security work is the boring kind done on a schedule. Assume whoever inherits this will have half your context and none of your patience.
What is actually at stake
Unlimited endpoints get abused eventually. This is the sort of thing that compounds, quietly, in both directions. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.
Your first week
- Find out what is already in place
- Limit by account and by address
- Change one thing and measure it
Return a clear response instead of failing silently. Where this goes wrong is almost never a lack of knowledge. It rarely shows up as a line item, which is exactly why it slips.
The short version
The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about rate limiting before you move on:
- Someone can say what the current setup is without going to look
- Return a clear response instead of failing silently — and you know whether that is true here
- There is a way to tell whether the last change to this helped
The point is not perfection, it is knowing which of these you have consciously chosen to skip.