Rate Limiting: Throttling Repeat Submitters by IP

Some abuse isn’t about one clever submission — it’s about volume. A single IP firing your contact form hundreds of times an hour. Rate limiting is the setting that caps that flood while leaving normal visitors untouched.

The two numbers that define a limit

Spamify’s rate limiter is a classic rolling window built from two settings:

• ratelimit_max — the maximum number of submissions allowed…
• ratelimit_window — …within this many seconds, per IP address.

So ratelimit_max = 5 and ratelimit_window = 300 means "no more than 5 submissions from one IP in any 5-minute stretch." The window rolls — it’s not a fixed clock reset — so a burst can’t game the boundary.

Choosing the numbers

Think about how a real person uses the form:

• Contact form: almost nobody submits more than once or twice in a few minutes. A low max over a several-minute window is safe.
• Comment forms on a busy post: allow a bit more headroom so an engaged commenter isn’t throttled.
• Shared networks (offices, schools, mobile carriers): many people can share one IP — don’t set the max so low that a legitimate crowd trips it.

What happens when the limit is hit

The ratelimit_action setting decides the response — block the excess submissions outright, or flag them for review. Blocking is the usual choice here, because exceeding a sane rate is a strong abuse signal on its own. If you serve a lot of shared-IP traffic, flag-for-review is the gentler option.

Rate limiting pairs naturally with the honeypot and timing checks: those stop the unsophisticated single hits, and the rate limiter stops the same source coming back for more.