Rate Limiting

Protects endpoints from brute force attacks and resource abuse by limiting requests to 5 per minute per IP address. The documentation drives home the cost angle with a compelling example: a startup's unsecured AI endpoint racked up $200,000 in charges during a 4-hour attack. Implementation is straightforward with a middleware wrapper that works standalone or stacks with CSRF protection. Best applied to contact forms, password resets, file uploads, and any expensive operations like AI API calls. The 5 requests per minute limit stops automated attacks without impacting legitimate users, though you'll want something more sophisticated for high-traffic production APIs that need granular control or distributed rate limiting.

skills.sh installs: 199
GitHub stars: 18
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add harperaa/secure-claude-skills --skill rate-limiting --agent claude-code

Installs into .claude/skills of the current project.

Files

Rate Limiting - Preventing Brute Force & Resource Abuse

Why Rate Limiting Matters

The Brute Force Problem

Without rate limiting, attackers can try thousands of passwords per second. A 6-character password has 308 million possible combinations.

Without rate limiting:

At 1,000 attempts/second → Cracked in 5 minutes

With our rate limiting (5 requests/minute):

At 5 attempts/minute → Would take 117 years

Real-World Brute Force Attacks

Zoom Credential Stuffing (2020): Attackers made over 500,000 login attempts using stolen credentials. Proper rate limiting would have detected and blocked this within the first few hundred attempts.

WordPress Distributed Attacks (2021): Multiple WordPress sites were targeted by distributed brute force attacks attempting millions of login combinations. Sites without rate limiting saw server costs spike as attackers consumed resources.