Rate limits
Per-form rate limit presets with the exact numbers, how they refill, and what a 429 looks like.
Rate limits stop one visitor, or one script, from flooding a form. Every form has a preset, and every limit is counted exactly, before the body is read. A rejected post doesn't use up any allowance.
Presets
| Preset | Per visitor and form | Good for |
|---|---|---|
| Standard (default) | 5 a minute, at most 3 in 10 seconds | Most forms |
| Relaxed | 20 a minute | Forms behind a login, internal tools, events on shared Wi-Fi |
| Strict | 2 every 10 minutes | Contact and sales forms, where a repeat is a double click or a bot |
| Custom | 1 to 1,000 every 10 seconds, minute, 10 minutes, hour or day | One entry per person, kiosks and other special cases |
The presets compared
Standard 5 a minute, 3 in 10 seconds14 of 120 accepted
Relaxed 20 a minute59 of 120 accepted
Strict 2 every 10 minutes2 of 120 accepted
How limits refill
Limits are a smooth allowance, not a fixed clock window. A quiet visitor starts with the full allowance and can use it at once. After that, one more post is allowed every window divided by limit: every 12 seconds for Standard, every 3 seconds for Relaxed and every 5 minutes for Strict. After a full quiet window the allowance is full again.
Standard also has a burst rule of 3 posts per 10 seconds, so its first burst is 3, not 5. Relaxed, Strict and Custom have no separate burst rule.
Limits that always apply
| Rule | Limit | Counted per |
|---|---|---|
| Flood guard, before the form is looked up | 600 a minute | IP, across every form |
| Cross-form | 30 a minute, or the Custom per-minute rate when higher | IP, across every form |
| Form-wide | 300 a minute, or a Custom cap of 1 to 10,000 | Form, across every visitor |
GET /f/<formId>/schema | 60 a minute | IP and form |
| The Ikiform check frame | 60 a minute | IP and form |
| REST API | 100 a minute | API key |
Custom rates faster than the flood guard are refused when you save; for example, a 10-second window allows at most 100. Loading a form's schema or the human check never spends the submit allowance.
Custom
- Submissions per visitor: a whole number from 1 to 1,000, and a window of 10 seconds, a minute, 10 minutes, an hour or a day.
- Form-wide cap per minute: optional, from 1 to 10,000. It replaces the 300 a minute default for the whole form.
- An hour or a day window suits one-entry-per-person forms such as giveaways or RSVPs. Remember that many people can share one IP, for example at an office or event.
When a limit is hit
The post is refused with 429 rate_limited and a Retry-After header with the whole seconds until the next post is allowed. Browser form posts see a hosted "Slow down" page. fetch code can read Retry-After, because Ikiform exposes it through CORS.
HTTP/1.1 429 Too Many Requests
Retry-After: 12
X-Request-Id: req_01k7v2c9t3e8m5q4x6z0a1b2c3
Content-Type: application/json; charset=utf-8
{"ok":false,"error":{"code":"rate_limited","message":"Too many requests. Please slow down."},"request_id":"req_01k7v2c9t3e8m5q4x6z0a1b2c3"}- Wait for
Retry-Afterseconds before sending again. - If honest visitors hit the limit, switch the form to Relaxed or Custom.
- If your server posts for visitors, every post shares your server's IP. See From a server.