Rate limiting is a server-side control that caps the number of HTTP requests an IP address, user session, or API client can send within a defined period—commonly 60 requests per minute for anonymous visitors or 300 per minute for authenticated users. When the threshold is exceeded, the server returns a 429 Too Many Requests status code and blocks further access until the window resets. You implement rate limiting to prevent several threats. Credential-stuffing bots that hammer login pages with stolen passwords can lock out legitimate users and burn CPU cycles. Scraper bots crawling thousands of pages per second can saturate bandwidth and inflate your CDN bill. Even well-intentioned crawlers, if misconfigured, can accidentally DDoS a small VPS. Rate limiting also protects APIs—if you expose a search endpoint or form processor, an attacker could loop requests to exfiltrate data or trigger costly third-party API calls on your dime. Most modern stacks offer multiple enforcement layers. Cloudflare and AWS WAF apply limits at the edge before traffic reaches your origin server. Nginx and Apache have native modules (ngx_http_limit_req_module, mod_ratelimit) that count requests per IP in a sliding window. Application frameworks like Django and Express have middleware packages that track limits in Redis or in-memory stores, letting you set granular rules per endpoint or user role. Common thresholds for public-facing pages range from 30 to 120 requests per minute per IP, while authenticated users might get 200 to 500. API endpoints often use token-bucket algorithms with burst allowances—10 requests per second sustained, but allowing short bursts of 20. The right number depends on your content: a blog tolerates lower limits than a real-time dashboard. At Ottawa SEO, we configure rate limiting on all client sites, usually at the CDN layer for simplicity and global coverage. We whitelist known-good bots by user-agent or IP range—Googlebot, Bingbot, Semrush—so they crawl freely, while capping unknowns to prevent surprise traffic spikes that trigger overage fees or downtime during a campaign launch.