Agent WranglersAbuse and limits
Limit how fast and how much anyone can ask for. Give the same answer either way, and check every price, step and count on the server.
- Required 6
- Recommended 2
Required
Limit requests per client
RequiredLimit how many requests one client can send to costly routes, such as search, sign-up, exports, AI calls and anything that sends email.
Give the same answer for known and unknown accounts
RequiredLogin, sign-up and password reset must answer the same way whether or not the account exists, so nobody can find out who has an account.
Work out every amount on the server
RequiredNever trust a price, quantity, discount or step order sent by the browser. The server works out every amount and checks that each step happened.
Make each change happen exactly once
RequiredChanges to money, stock and single-use items must happen once, even when the same request arrives twice at the same moment.
Cap the size of every request and answer
RequiredPut a ceiling on everything a client can make the server do, such as page sizes, upload sizes, query depth and pattern matching time.
Confirm payments on the server
RequiredMark an order as paid only after the payment provider confirms it through a signed webhook or its API. Never trust the return to your success page.
Recommended
Stop spam and fake sign-ups
RecommendedMake forms costly for bots and cheap for people. Never let a form send unlimited email to addresses the visitor types in.
Protect free tiers from automated abuse
RecommendedLimit what one person can take from a free plan or trial, so scripts cannot create endless accounts to get free use.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits.