How to Fix the “429 Too Many Requests” Error

A "429 Too Many Requests" error means something sent too many requests too quickly, and a rate limit kicked in to slow it down. It is a protective response — the fix is to find what is being so demanding and calm it down.

What triggers a 429

Aggressive bots or scrapers hammering your site.
A misbehaving plugin making rapid repeated calls.
Too many login attempts tripping a security limit.
An API or script calling faster than allowed.

Step 1: Work out who is making the requests

Check your visitor logs in the cPanel Metrics section. If one IP or user agent is responsible for a flood, that is your answer.

Step 2: Block or slow the source

Bad bots — block them; see blocking bad bots with .htaccess.
A single abusive IP — block it; see blocking an IP in cPanel.
A CDN like Cloudflare in front can absorb and rate-limit this traffic for you.

Step 3: If it is your own plugin or API

A plugin polling too often, or your own script calling an external service too fast, can trip a 429 from that service. Reduce the frequency, add a short delay between calls, and cache responses so you request less often.

Frequently asked questions

I get a 429 trying to log in to my own site.

A login-protection limit has flagged repeated attempts. Wait for the limit to reset, then log in carefully. If you are locked out longer, confirm your IP is not blocked by a security tool.

An external service returns 429 to my site.

You are calling its API faster than it permits. Slow your requests, respect its rate limits, and cache results so you do not re-request the same data repeatedly.

The error comes and goes on its own.

Rate limits reset after a short window, so intermittent 429s often reflect bursts of bot traffic. If it keeps returning, identify and block the source rather than waiting it out each time.