A short guide to rate limiting

We end up explaining this on discovery calls often enough that it deserved writing down. Everything we would tell a client about rate limiting in the time it takes to drink a coffee.

The cheapest security work is the boring kind done on a schedule. The teams that stay on top of it are the ones who put it on a calendar rather than a wish list.

What it costs to ignore

Unlimited endpoints get abused eventually. Small and consistent beats large and occasional here. It is the sort of thing that looks like polish right up until it costs you an enquiry.

How we handle it

Limit by account and by address. The teams that handle this well are rarely the ones with the biggest budgets. If two people in the business would answer this differently, that gap is the actual problem.

Warning signs

Return a clear response instead of failing silently. Where this goes wrong is almost never a lack of knowledge. Check it against what you would want a competitor's site to get wrong.

The short version

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about rate limiting before you move on:

• Someone can say what the current setup is without going to look
• Limit by account and by address — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Most of the value here comes from doing the first two things, not all of them.