Rate limiting explained.
Rate limiting caps how many requests a single client can make within a window of time, throttling abusive or runaway senders before they overwhelm a service.
How rate limiting works
A rate limit is a rule of the form "no more than N requests per window" applied per client, where the client is identified by something like an IP address or an API key. The service keeps a running count for each client, and while a client stays under its allowance the requests pass through normally. Cross the threshold and further requests are rejected, usually with a 429 Too Many Requests status and often a header telling the caller when to try again.
Common implementations use a fixed window, a sliding window, or a token bucket that refills at a steady rate, but the goal is the same: no single caller can consume a share of capacity that starves everyone else or floods what sits behind it.
For a form backend that flood is spam. A bot script can fire thousands of submissions a minute at a public endpoint, so rate limiting caps how many any one source can send, which blunts abuse before it reaches your inbox. FormWire pairs it with honeypot fields and captcha as layers of spam protection.
What a rate limit protects.
Caps abuse
A bot hammering your endpoint hits the ceiling and is throttled, so mass spam submissions never reach your inbox in bulk.
Protects capacity
No single runaway or malicious client can consume the share of resources that everyone else depends on.
One layer of many
It sits alongside honeypot fields and captcha, since each catches a different kind of unwanted submission.
Related questions
Typically HTTP 429 Too Many Requests, often with a Retry-After header telling the caller how long to wait before trying again. A well-behaved client backs off and retries later; an abusive one simply keeps hitting the ceiling and stays throttled.
Not if the limits are set for human behavior. A person filling in a form submits once or twice, far below any sensible threshold, while a bot firing hundreds of requests a minute crosses it immediately. The limit is tuned to let genuine use through and catch the abnormal volume.
How FormWire filters spam →No. It caps volume from a single source but doesn't judge whether a submission is genuine, so a slow, distributed bot can stay under the limit. That's why it works as one layer, combined with honeypot fields and captcha that catch spam a rate limit would miss.
FormWire caps how many submissions a single source can send to your endpoint in a window, so a script can't flood it. This runs automatically as part of spam protection, alongside honeypot detection and optional captcha, with no configuration needed to get the baseline.
Want to see it working?
Read the docsKeep bots off your form.
Free tier forever. No credit card required.