Rate Limiting & Throttling
Protect your endpoints from brute force and denial of service attacks. Test rate limiting thresholds using the simulation below.
Rate Limiter simulation
Press the button below to hit a throttle-configured route. The route allows a maximum of 5 requests per minute.
Remaining Requests
Status Code
How Rate Limiting Works
HTTP 429 Too Many Requests
When request counts exceed the configured rate limiter limit (e.g. 5 requests), Laravel aborts the lifecycle immediately and returns an HTTP 429 response code with a `Retry-After` header specifying wait seconds.
Token Bucket Algorithm
Laravel's rate limiter uses the Token Bucket algorithm. The bucket has a maximum capacity. Each request removes one token. Tokens are regenerated at a constant rate over time.
Redis Throttle Backend
In production clusters, storing rate limiting values in local file caches causes issues as requests are split across multiple servers. Redis acts as a shared central store, ensuring rate limit synchronization.