Agent WranglersAbuse and limits Required
Limit requests per client
Limit how many requests one client can send to costly routes, such as search, sign-up, exports, AI calls and anything that sends email.
How to do it
Count requests per client address and per account over a one-minute window, such as 20 searches and 5 sign-ups. Answer 429 Too Many Requests with a Retry-After header once the limit is reached. Set tighter limits on routes that cost money or send messages. Logins have their own rule in slow down password guessing. The website rate limits rule covers the HTTP headers.
Example
HTTP/1.1 429 Too Many Requests
Retry-After: 60How to check
Send 30 searches and 10 sign-ups in one minute from one test client. The later ones get 429, and the limit resets after the window.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/limit-requests.