How to fix a 429 Too Many Requests error

A 429 Too Many Requests error means a rate limit decided that one client sent too many requests in a short time. It is a protective response, not a crash. The key to fixing a 429 error is working out which layer sent it: your application, a security plugin, a firewall, Cloudflare, or a third-party API your site calls.

Before you start

• The URL, the time, and your public IP (check it with our IP checker).
• Look at the error page: Cloudflare, WordPress plugins and APIs each style their 429 page differently.

Common causes of a 429 error

• Login protection after repeated wp-login.php or xmlrpc.php requests.
• Cloudflare rate limiting rules matching your traffic.
• Crawlers and SEO tools requesting pages too fast.
• Scripts, cron jobs or uptime monitors polling an endpoint aggressively.
• Outgoing API calls from your site exceeding the provider's quota (the 429 comes from their API, shown inside your site).

How to fix a 429 error as a visitor

1. Wait a few minutes. Most limits reset within a minute to an hour; a Retry-After header says how long.
2. Stop reloading. Every refresh counts as another request.
3. Disable VPNs that share an IP with many other users.

How to fix a 429 error as a site owner

1. Identify the source. Open cPanel → Metrics → Raw Access and search for 429 . If there are no 429 lines but visitors see them, the limit is applied before your server, usually by Cloudflare.
2. Review Cloudflare rules. In Security → Events find the rule that fired and loosen its threshold or exclude paths such as /wp-admin/admin-ajax.php. See Cloudflare rate limiting rules.
3. Check security plugins. Plugins like login limiters return 429 after failed attempts. Whitelist your own IP and reset the lockout.
4. Tame bots. Use robots.txt Crawl-delay for crawlers that respect it, and block abusive user agents.
5. Fix your own scripts. Add delays and caching to cron jobs and API clients, and respect Retry-After with exponential backoff.
6. If the 429 is from an external API, check that provider's dashboard for your quota and upgrade or cache results.

What to check afterwards

Repeat the action after the limit resets and watch the access log. 429 lines should disappear for normal traffic while abusive clients are still throttled.

FAQ

How long does a 429 error last?

It depends on the rule: from seconds to an hour. Check the Retry-After header.

Does a 429 error hurt SEO?

Googlebot treats 429 as "slow down" and crawls less. Short bursts are fine; persistent 429s to Googlebot are not.

Is 429 the same as being blocked?

No. A block (often 403) is persistent; a 429 limit lifts on its own. See why your IP is blocked.

Next steps

• Protect WordPress login and XML-RPC
• HTTP error codes explained
• Open a ticket if you cannot find the limit.