Missing or Insufficient Rate Limiting

Medium Severity Technical Guide

Vulnerability Description

Without rate limiting, public API endpoints and login routes are vulnerable to brute-force attacks, credential stuffing, denial-of-service (DoS) attempts, and resource exhaustion.

Remediation Guide

To resolve this vulnerability, follow these config changes or developer practices:

Enforce request rate limits on sensitive endpoints using Redis or web application firewalls (WAFs). Return HTTP 429 Too Many Requests when limits are exceeded.

Verify Your Fix

After applying the remediation, run an external attack-surface scan to verify that the vulnerability is no longer detected by WebScanify.

Is your website vulnerable?

Run a free security scan now to identify missing headers, outdated JS, and other deployment vulnerabilities.