A 429 Too Many Requests error means a server, whether your own website, a plugin's rate limiter, or a third-party service you connect to, is refusing new requests because too many arrived in a short window. It's a rate-limiting response, not a sign that your site is broken or hacked.
What Causes a 429 Error
The most common causes are:
- A security plugin or firewall rule that limits how many times one visitor can load a page or hit the login form in a short period.
- A bot, scraper, or automated script sending rapid repeat requests to your site.
- A WordPress plugin or theme making too many calls to an external API (payment gateway, mapping service, analytics) that has its own rate limit.
- Your own testing or a misconfigured script repeatedly refreshing the same page or endpoint.
How to Fix It
1. Wait and Reload
Rate limits are usually temporary. Wait a minute or two and reload the page. If the error clears on its own, the limit has simply reset and no further action is needed.
2. Check for a Security or Rate-Limiting Plugin
If you run WordPress, a security plugin (login protection, firewall, or a "limit login attempts" type plugin) is a frequent cause. Log in to wp-admin, open the plugin's settings, and check whether its rate limit or lockout threshold is set too aggressively for normal visitor traffic. Raising the threshold, or excluding trusted IP addresses, usually resolves it.
Don't disable your site's login protection entirely to fix this. Adjust the threshold instead, so you stay protected against real brute-force attempts.
3. Review Your .htaccess File
Some rate limiting is configured directly at server level through directives in your .htaccess file. If you or a previous developer added request-limiting rules, open the file through your hosting control panel's file manager and check for anything unusual near the top of the file. Comment out a suspect rule with a # at the start of the line, save, and test again.
4. Check Third-Party API Limits
If the 429 error only appears when a specific feature runs, such as a shipping calculator, map, or payment form, the limit likely belongs to that external service rather than your own hosting. Check the service provider's dashboard for your usage and rate limit, and contact them if you've genuinely outgrown your plan.
5. Contact Support If the Cause Isn't Clear
If none of the above explains it, reach out to your hosting provider's support team with the exact page, time, and any error details you have. They can check server-level logs to confirm whether the limit is coming from your application, a security layer, or somewhere else.
For a related error caused by a security rule blocking a request outright rather than throttling it, see How to Fix a 403 Forbidden Error Caused by ModSecurity.