4294xx
4xx — Client Error
Too Many Requests
The user has sent too many requests in a given amount of time (rate limiting).
What it means
The HTTP 429 Too Many Requests response status code indicates the user has sent too many requests in a given amount of time (rate limiting).
A `Retry-After` header might be included to this response indicating how long to wait before making a new request.
How it works
- 1A client makes 100 API requests in 1 second.
- 2The server's rate limiter allows a maximum of 60 requests per minute.
- 3The server drops the 61st request and returns 429.
Why you're seeing this
- • Exceeded API quota or rate limit.
How to fix it
- • Implement exponential backoff in your client code. Read the `Retry-After` header and wait exactly that long before making the next request.
Framework Implementations
Express.js (express-rate-limit)
const rateLimit = require('express-rate-limit');
app.use('/api/', rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100 // limit each IP to 100 requests per windowMs
}));Real-Life Scenarios
Use this extensively on all public API endpoints to prevent abuse, scraping, and DoS attacks. Rate limiting is a fundamental API security practice.
Brute Force Protection
An attacker tries guessing passwords on a login page. After 5 attempts, the server returns 429 and blocks their IP for 15 minutes.
HTTP Transaction
1. Client Request
GET /api/data HTTP/1.1 Host: api.com
2. Server Response
HTTP/1.1 429 Too Many Requests
Retry-After: 60
Content-Type: application/json
{"error": "Rate limit exceeded. Try again in 60 seconds."}SEO Implications
Googlebot respects the Retry-After header. However, aggressively rate-limiting Googlebot can severely damage your SEO crawl rates.