# Rate limits

Form Plume rate limits cap sustained traffic and bursts per form, returning a 429 with a Retry-After header so your client knows when to retry.

One person submitting twice is normal. Hundreds of requests in a few seconds are not.

Rate limits control sustained traffic and short bursts for each form. Form Plume uses a soft client fingerprint so one abusive source cannot consume the entire form's allowance.

## What the limits are

Form Plume applies two sliding-window estimates per form and submitter, configured by default with a limit of 1 submission over 30 seconds and 20 submissions over 10 minutes. The key combines the form, IP address, user agent, and accepted language. Both windows can be configured per form. The current limiter is in memory, so limits apply per running API process and reset when that process restarts.

A limited request is rejected before storage or [spam scoring](/docs/spam-protection/scoring). Use the [time trap](/docs/spam-protection/time-trap) as a separate timing signal for requests that remain within the traffic limits.

## When a request is limited

A request that asks for JSON receives `429 Too Many Requests` with `Retry-After`. Native HTML submissions receive a `303 See Other` redirect to the form's configured error page or Form Plume's hosted error page with `fp_error=rate_limited`.

JavaScript clients should request JSON and wait before trying again:

```js
const response = await fetch(form.action, {
  method: "POST",
  headers: { Accept: "application/json" },
  body: new FormData(form),
});

if (response.status === 429) {
  const wait = response.headers.get("Retry-After");
  showError(`Too many attempts. Try again in ${wait} seconds.`);
}
```

Do not retry immediately in a loop. That creates more traffic and keeps the client limited for longer.