The real cost of ignoring rate limiting

It comes up on almost every project, usually later than it should. Nobody bills you for neglecting rate limiting. The cost shows up somewhere else.

The realistic threat for most small businesses is automated and opportunistic, not targeted. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

Where the cost lands

• Time spent on work that should not have been necessary
• Enquiries that quietly never arrive
• Unlimited endpoints get abused eventually
• Rework, once the problem is finally visible

Limit by account and by address. That sounds obvious written down. It is still the thing most often skipped. It rarely shows up as a line item, which is exactly why it slips.

Making it stick

Return a clear response instead of failing silently. It is worth being explicit about, because assumptions differ quietly. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

What this looks like day to day

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about rate limiting before you move on:

• Someone can say what the current setup is without going to look
• Limit by account and by address — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Pick the one that would hurt most if it failed, and start there.