Rate limiting rules that punish your own users: the three classic mistakes

Rate limiting rules that punish your own users: the three classic mistakes

Most rate limiting rules go wrong not because the threshold is too low, but because the counting key is wrong.

Mistake 1: counting by IP alone. Corporate networks, universities and mobile carriers put hundreds of users behind one address. A limit of 100 requests per minute is hit by one office at lunchtime.

Mistake 2: counting every request. A single page load fetches CSS, fonts, images, tracking beacons. Twenty assets per page means a "10 requests per 10 seconds" rule blocks the first visit. Scope the rule to HTML responses or specific paths.

Mistake 3: no distinction between GET and POST. Login forms and search endpoints need tight limits. Static pages don't.

Fix: build the rule around a path pattern and a method, use IP plus a header or cookie as the counting characteristic where your plan allows it, and start with "log" action for a day before switching to "block".