HTTP Status Codes

429 Too Many Requests

The client has been rate limited for sending too many requests. A Retry-After header should tell it when to try again.

What it means

429 Too Many Requests (RFC 6585) is returned when a client exceeds a rate limit. A good response includes Retry-After (seconds or a date) and often RateLimit-* headers describing the limit, remaining quota and reset time, so clients can back off precisely.

HTTP RESPONSE
HTTP/1.1 429 Too Many Requests
Retry-After: 30
RateLimit-Limit: 100
RateLimit-Remaining: 0
RateLimit-Reset: 30

Why it matters

  • It protects services from overload and abuse while giving clients a clear backoff signal.
  • Retry-After and rate-limit headers turn a rejection into cooperative throttling.

Common mistakes

  • Returning 429 without Retry-After, so clients retry blindly and worsen the overload.
  • Rate limiting by IP alone, which penalises users behind shared NAT.

How WebInspect checks this

  • The API Inspector reports rate-limit headers and whether 429 responses include Retry-After.