429 Too Many Requests Error: Why Your Site Is Blocking Visitors

Visitors or you see "429 Too Many Requests" — something protecting your site decided one browser or address was asking for too much, too fast, and told it to slow down.

Common signs of this issue

• A page shows "429 Too Many Requests", "HTTP Error 429", or "You are being rate limited" instead of your site.
• It happens after clicking around quickly, refreshing a lot, or working in the WordPress dashboard for a while.
• Only some people are affected — often everyone in one office, on one school or hotel network, or on one mobile provider.
• A Cloudflare-branded page mentions error 1015 or rate limiting.
• A plugin, form, or integration logs errors mentioning 429 when it talks to an outside service such as a payment, email, or maps provider.
• Search Console reports crawl problems or server errors at the same time the blocks started.

Safe checks you can do yourself

None of these require sharing passwords with anyone.

• Read the error page closely and screenshot it. A Cloudflare page, a host-branded page, a security plugin message, and a bare server message point to four different culprits. The wording and logo are your best clue.
• Note the time and your IP address (search "what is my IP") when it happens. Anyone reviewing firewall logs will need both to find the block.
• Wait ten to fifteen minutes and try again from the same device. Most rate limits are temporary; if access returns on its own, you are dealing with a rate limit, not a broken site.
• Try from another network, such as your phone on mobile data. If it works there, your office or home IP address is being limited, not the site as a whole.
• If you use Cloudflare, log in and open the Security section and its events log. Filter by your IP address or the time of the block to see which rule fired, such as a rate limiting rule you or a plugin set too tight.
• In WordPress, check any security plugin (for example Wordfence, Solid Security, or your host's own tool) for a rate limiting or live traffic screen. Look for your own IP or a legitimate service listed as blocked.
• If the 429 only appears in the WordPress dashboard, leave fewer admin tabs open. Each open editor tab keeps sending background Heartbeat requests through admin-ajax.php, and several tabs at once can trip a strict host limit.
• Check your hosting dashboard or ask support whether the server has its own request or connection limits, and whether your IP or a bot has hit them. Some hosts return 429 where others return 508 Resource Limit Is Reached.

What this usually means

A 429 is a deliberate response, not a crash. Something between the visitor and your pages — Cloudflare, your host's firewall, a security plugin, or the web server itself — counts requests from each address and refuses more once a threshold is passed. It is there to stop bots from scraping, hammering login pages, or overloading the server, which is a good thing. The trouble starts when the limit is set too tight, or when many real people share one address, like an office behind a single router or mobile users on a shared carrier address.

On WordPress sites the most common triggers are aggressive bots crawling every page at once, brute-force login attempts, and the site's own background activity: the Heartbeat feature, page builders, and plugins that poll admin-ajax.php every few seconds. A 429 in a plugin's log is a different story. There, your site is the one being told to slow down, by an outside service with an API limit — for example a shipping, email, or reviews service — usually because a plugin is calling it far more often than it should.

Google treats 429 much like a temporary server overload: Googlebot slows its crawling and tries again later. That is harmless for a short spell, but if Googlebot or legitimate services keep getting 429 for days, pages can drop out of the index. So the fix is not to switch protection off, but to tune it so it catches abusive traffic while letting customers, search engines, and your own tools through. If the block is outright and permanent rather than a slow-down, you are more likely looking at a 403 Forbidden error.

What not to do

• Don't keep refreshing the page. Every refresh counts as another request and resets the clock on the block.
• Don't switch off your firewall, security plugin, or Cloudflare entirely to make the error go away. That trades a nuisance for an open door.
• Don't block whole countries or large IP ranges in a panic. You will lock out real customers along with the bots.
• Don't whitelist an IP address you do not recognize just because it is being blocked a lot. Find out what it is first.
• Don't ignore 429 errors reported for Googlebot. A few are fine; a steady stream can cost you rankings.
• Don't upgrade hosting just to escape a 429 before checking whether a plugin or bot is causing the flood of requests.

When to get help

Get help if customers keep reporting the error, if it hits checkout or contact forms, or if you cannot tell which of several layers — Cloudflare, host firewall, security plugin — is doing the blocking. Rate limits are layered, and loosening the wrong one does nothing except make the site less safe. Someone who can read the firewall and access logs can see exactly which addresses are being limited, separate the bots from the buyers, and set rules that stop abuse without turning away a whole office of real customers or Google's crawler.

Glenn runs WebsiteSelfHelp and untangles rate-limit and firewall problems like this for small business sites. Send a screenshot of the error and roughly when it happens, and he will come back with a plain explanation of what is blocking people and what it will take to fix — you do not need to hand over passwords to start.

Frequently asked questions

Related free guides