SR
EN
DE
SLSecurity
What is rate limiting and why every system needs it
Rate limiting caps the number of requests per unit of time and protects the system from abuse and overload. We explain it simply.
Rate limiting is a technique limiting how many times someone — whether a real person or an automated script or bot — can send a request to the system in a short time period. A practical example: how many times someone can try to log in to an account, or submit a contact form, before the system temporarily blocks further attempts.
What rate limiting concretely protects against
Password guessing (known as a brute-force attack) — without a limit, an attacker could automatically try thousands of passwords per minute until hitting the right one; with rate limiting, after a few wrong attempts further tries are temporarily blocked, making such an attack impractical.
Spam through forms and API calls — it limits how many times the same form or the same API endpoint can be used from the same address in a short period.
Server overload (unintentional or intentional) from an extremely large number of requests in a short time, which could otherwise slow down or crash the whole system for all users.
How rate limiting is practically applied
It is set at the level of APIs and forms with reasonable, concrete thresholds — for example, at most five login attempts per minute per IP address is a common rule. Legitimate users in practice never notice it because they rarely fail five times in a row within a minute, while automated abuse is effectively slowed down or blocked entirely.
Nikola Cerić
Founder & CEO, Manage IT
More than 10 years of software development experience — in his own company and in major IT companies across the Balkans.