---
title: "Limit requests per client · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/limit-requests
updated: 2026-10-20
licence: "All rights reserved"
---

# Limit requests per client

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)
- Rule: Limit how many requests one client can send to costly routes, such as search, sign-up, exports, AI calls and anything that sends email.
- How: Count requests per client address and per account over a one-minute window, such as 20 searches and 5 sign-ups. Answer `429 Too Many Requests` with a `Retry-After` header once the limit is reached. Set tighter limits on routes that cost money or send messages. Logins have their own rule in [slow down password guessing](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/login-guessing). The [website rate limits rule](https://agentwranglers.se/playbook/website/security/rate-limits) covers the HTTP headers.
- Check: Send 30 searches and 10 sign-ups in one minute from one test client. The later ones get 429, and the limit resets after the window.

Example:

```http
HTTP/1.1 429 Too Many Requests
Retry-After: 60
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/limit-requests`.

- Next: [Give the same answer for known and unknown accounts](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/no-account-enumeration)
- [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)