A 429 means something is being told it has made too many requests. The interesting question is who — a crawler hammering the site, a plugin polling an API in a loop, or a legitimate visitor caught by a rule set too tight. The response is very different depending on the answer.
Before you buy, one quick check
Read-only.
Load the site on mobile data with wi-fi off. If it works there but not on your normal connection, your own IP is the one being limited — often after repeated login attempts or a security plugin rule.
If it fails on both, the limit is not about you, and this fix is the right one.
HTTP 429 too many requests
Requests are being rate-limited and refused. We find what is being throttled and why, then fix the cause — whether that is a bot, a plugin, or a misconfigured limit.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
This or something else?
| 429 error in the browser | This fix covers it |
| Only you are blocked, others fine | This fix covers it |
| Locked out of login specifically | Locked out of wp-admin |
| Host emailed about resource abuse | This fix covers it |
| 503 rather than 429 | Gateway timeout diagnosis |
What you are seeing
- A 429 error, on the whole site or on specific endpoints
- It may affect only you, only some visitors, or everyone
- Your host may have emailed about excessive requests
- It may coincide with an API integration you recently added
Common causes
- A crawler or bot making far more requests than your plan allows
- A plugin polling an external API on every page load
- A security plugin rate-limiting legitimate traffic too aggressively
- REST API or admin-ajax endpoints being hit in a loop
- A CDN or host-level limit set lower than your traffic needs
What we do
- Take a full backup before touching anything
- Identify which requests are being limited, and by which layer
- Determine whether the source is a bot, a plugin, or a rule that is too tight
- Block or slow the abusive source, or fix the plugin behaviour
- Adjust limits so legitimate traffic is never caught
- Monitor to confirm the limiting has stopped
What is included
- Normal traffic served without rate limiting
- A note naming what was being throttled and why
- Crawler and bot rules reviewed, so the right things are blocked and the wrong things are not
- The pre-fix backup, kept for 30 days
Not included
- Increasing limits on a host or CDN we cannot access
- Defending against a sustained denial-of-service attack, which needs infrastructure
- Full security hardening, which is a separate service
- Design changes or content work
Questions about this fix
Is this an attack?
Sometimes, but far more often it is mundane — a badly behaved crawler, or a plugin checking a licence on every single page load. We tell you which, and only escalate to security work if the evidence points that way.
Only I am blocked. Why?
Almost always a security plugin that flagged your IP after failed logins or rapid admin activity. Clearing that is quick, and we also check the rule that caught you so it does not happen again.
Could blocking bots hurt my search rankings?
Only if it is done carelessly. Search crawlers are identified and allowed through — the point is to block the ones providing no value while leaving Google, Bing and the AI crawlers you want to keep.
My host says I need a bigger plan. Do I?
Occasionally. But most 429s we see come from a specific source making unnecessary requests, and removing that source brings usage well back inside the current plan. We check that before agreeing you need to spend more.
I don't run a security plugin. Can this still happen?
Yes — rate limiting can be applied by your host, a CDN, or even the remote API a plugin polls, not just a security plugin on the site itself. We check all three, not just the obvious one.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.