More fixes

429 Too Many Requests on a WordPress site

A 429 is not a crash. It means something between the visitor and your site is counting requests, decided this visitor (or this server) made too many, and is turning them away for a while. The fix is to find which counter it is and what is feeding it - usually a bot, a busy admin screen or a plugin calling out too often - rather than raising the limit until the problem goes quiet. Below is a rebuilt example (not a real client), how to find the counter, and the fix for each one.

First: find out who is saying 429

1. Look at the error page itself. A Cloudflare page that says "Error 1015 - You are being rate limited" is Cloudflare. A plain white page with your host's logo, or the words "mod_security" or "Imunify", is the host. A page in your own theme, or a Wordfence or iThemes/Solid Security notice, is a plugin inside WordPress. A 429 that only shows inside the admin (an update that fails, a plugin's "API error 429") is a remote service turning your server away, not your visitors.
2. Check whether it is everyone or one place. Try from your phone on mobile data, not the office Wi-Fi. If the site works there, the counter has blocked one address: yours, your office, or a shared connection many people use.
3. Read the logs for what is doing the counting. Your host's raw access log (cPanel: Metrics > Raw Access, or ask support) shows each request with its address and page. Sort by address: one address or one page (wp-login.php, xmlrpc.php, wp-admin/admin-ajax.php, /wp-json/, a search or calendar page) asking hundreds of times a minute is the feeder. Wordfence's Live Traffic and Cloudflare's Security > Events show the same thing with the rule that fired.

The causes, most common first

1. Bots hammering one page. Scrapers, SEO crawlers and AI crawlers can ask for thousands of pages, and calendar or search pages with endless date and filter combinations give them a page that never runs out. The host or a plugin starts handing out 429s, and real visitors on the same shared limit get caught too. Block or slow the worst crawlers by name (Cloudflare's bot settings, or robots.txt for the polite ones), and add noindex plus a robots.txt Disallow to the endless calendar and filter addresses.
2. Login and XML-RPC attacks. Password-guessing bots hit wp-login.php and xmlrpc.php all day. The host's protection answers with 429 (or 403) and sometimes blocks the whole site for a while. Turn off XML-RPC if nothing you use needs it (the Jetpack app and some publishing tools do), limit login attempts, and add two-factor login. The goal is that the attacks cost nothing, not that the limit gets higher.
3. Your own admin screen. The WordPress Heartbeat, page builders that autosave, and plugins that poll admin-ajax.php every few seconds can make a busy editor look like a bot - especially with several tabs open, or several staff behind one office address. Close spare tabs, slow the Heartbeat (Heartbeat Control or your speed plugin's setting, 60 seconds instead of 15), and ask the host to raise the limit for your office address rather than for everyone.
4. A security rule set too tight. Wordfence's Rate Limiting, Solid Security, or a Cloudflare rate-limiting rule may treat normal browsing as an attack: a gallery page loads 40 images, a shop page makes a dozen requests, and the rule counts every one. Open the rule that fired, raise it for human visitors, or exclude static files (images, CSS, JavaScript) from the count. Never switch the protection off for good to make the error go away.
5. A plugin calling a remote API too often. Updates that fail with 429, an "Instagram feed error", "Google Maps quota", a shipping-rates or currency plugin that stops working: here the remote service is limiting your server. Usually a cron job or every page view is calling it instead of saving the answer for a while. Turn on the plugin's caching, lower its refresh rate, and check that one plugin is not installed twice. On cheap shared hosting many sites share one address, and a neighbour can use up the quota for everyone; then the host or a dedicated address is the fix.
6. Your host's resource limit dressed as a 429. Some hosts send 429 (others send 503 or "508 Resource Limit Reached") when the account runs out of processes. That is a slow site under load, not a counter: fix the slow pages and add page caching, and the limit stops being reached.

What you see, what it means, what it needs

What not to do

• Do not just raise the limit, or switch the rule off, and walk away. The bot or the polling is still there, still using your server, and the next limit you hit is the host's - which takes the whole site down instead of one visitor.
• Do not block Googlebot or Bingbot to stop the load. Check that a "Googlebot" in the log really is Google (a reverse lookup ends in googlebot.com); many scrapers use the name. Blocking the real one takes you out of search.
• Do not clear or reinstall WordPress. A 429 comes from a counter, not from broken files, and a reinstall changes nothing it counts.

Once you know which counter is saying 429 and what is feeding it, the fix is usually one rule or one setting. If you would rather hand it over, or the error keeps coming back, that is what the box below is for. Related: a WordPress site that is slow, 403 Forbidden (the same protections often answer with 403) and updates that fail to install.