Error 429 Too Many Requests: who is asking too much, and what to do

The short answer: 429 means “you asked too many times in a short time: wait”. It appears from two sides: you receive the error (from a site, a protection or an API your program connects to), or it is your site that returns it to whoever insists (a bot, an attacker, a program of yours with a loop).

When you are the one receiving it

Where What to do
On a site, while browsing or logging in Wait a few minutes and try again, without insisting. If you were trying passwords, the site blocked you on purpose.
On an API your program connects to Wait the time the reply indicates (the Retry-After header) and make fewer requests: batch them and keep the answers. Try again with longer and longer waits.
From WhatsApp, Google or another service Each service has its own quotas: see the documentation, and do not repeat the request in a hurry.
Without doing anything special You may be sharing an address with other people (a company or mobile network). Try another network.

When it is your site returning it

1 Find out who asks too much. cPanel’s access logs (or the server log) show the addresses and the most requested paths: Errors and Raw Access.
2 If they are bots, limit them: AI bots crawling your site. On a VPS: Rate limiting in nginx.
3 If it is an abusive address, block it: Blocking an address.
4 If it is your own program (a loop calling the site non-stop), fix it.
5 If it is an attack, see whether it really is one or just a spike: DDoS attack or just a traffic spike.
Do not remove all limits just to make the error go away. A reasonable limit protects the site, and real visitors rarely hit it. See also Protecting the WordPress login.

Do your visitors get the 429 and you do not know where it comes from? Open a ticket with the address and a time when it happened.

Open a support ticket

SEE ALSO

AI bots crawling your site: robots.txt and how to block them

Blocking an IP address from visiting your site

DDoS attack or just a traffic spike: how to tell, and what to do

Rate limiting in nginx: slowing down bots and password guessing

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $5.36/mo (3-year plan, with coupon)

See plans
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

How to access cPanel Control Panel? cPanel is the control panel where you manage everything in your hosting account - files, e-mail accounts, databases, bac...
How to create an e-mail account in cPanel? Creating a professional e-mail address on your own domain - such as info@yourdomain.co.mz - takes less than a minute in...
How to change your cPanel password There are two ways to change your cPanel password, and the difference is simple: one needs the current one, the other do...
What can you do in cPanel? cPanel is the control panel included with your hosting plan. Everything about your site - files, e-mail, databases, doma...
Your cPanel access details To log in to cPanel you need three things: the address, your username and your password. This page explains what each on...
Error 401 Authorization Required: a password box you did not expect The short answer: when a folder or a site opens a box asking for a username and password from the browser itself (not a...