Rate Limiting and Brute-Force Protection
Rate limiting caps how often an action can be attempted, turning attacks that depend on volume — brute-forcing passwords, credential stuffing, scraping, abuse — into slow, expensive, or impossible ones. It is a simple control with broad reach: almost any endpoint that an attacker would want to hammer benefits from a sensible limit.
Where should you apply rate limiting?#
Anywhere volume equals attack:
- Login and MFA — the classic brute-force and credential-stuffing target.
- Password reset and account creation — abuse and enumeration.
- APIs — scraping, cost abuse, denial of service.
- Any expensive operation — search, export, email sending.
Crucially, limit on multiple keys — per account and per IP and per device — because attackers deliberately spread load to evade a single dimension.
What are the common bypasses?#
| Bypass | Counter |
|---|---|
| Rotating IPs / botnet | Limit per account and device, not just IP |
| Spreading across accounts | Global anomaly detection, MFA |
| Unlimited sibling endpoints | Cover every path, including APIs |
| Slow, low-volume attempts | Long-window limits, lockout escalation |
How does it fit account security?#
Rate limiting is one layer, not the whole defense. Pair it with escalating friction — a CAPTCHA or step-up MFA after failed attempts — and with account-takeover prevention more broadly.
Rate limiting underpins brute-force and abuse defense across the site. More at the Web Security hub.
Frequently asked questions#
What is rate limiting?
Rate limiting caps how many times an action can be performed in a given period — for example, five login attempts per minute per account. It blunts brute-force attacks, credential stuffing, scraping, and denial-of-service abuse by making high-volume attempts slow, expensive, or impossible.
How do attackers bypass rate limits?
By spreading attempts to look legitimate: rotating IP addresses (often via botnets), distributing across many accounts (credential stuffing), and finding endpoints that lack limits. Effective defenses limit on multiple keys — account, IP, and device — and add friction like CAPTCHA or MFA when thresholds are hit.