A WordPress 429 Too Many Requests error means a server, CDN, firewall, security plugin, or API has temporarily blocked requests because too many requests were sent within a limited period.
You may see “429 Too Many Requests” while logging in, using wp-admin, calling the WordPress REST API, running WooCommerce integrations, submitting forms, crawling the site, or receiving heavy bot traffic.
The error is usually a rate-limiting problem rather than a broken WordPress installation.
The key is to identify which layer is enforcing the rate limit and why so many requests are being generated.
QUICK ANSWER
If WordPress returns 429 Too Many Requests, stop repeatedly refreshing the page and wait briefly before testing again. Then check Cloudflare, security plugins, hosting firewall logs, REST API traffic, bot activity, login attempts, and plugins that send frequent background requests. Reduce excessive polling or API calls, adjust only the relevant rate-limit rule, and block abusive bots if necessary. If the 429 comes from an external API, respect its retry interval and request quota instead of continuously retrying.
What Does 429 Too Many Requests Mean?
HTTP 429 is a rate-limit response.
A system may decide that one visitor, IP address, user, plugin, bot, or API client is sending too many requests within a certain time window.
A simplified example:
Allowed:
100 requests per minute
Received:
180 requests per minute
Result:
429 Too Many RequestsThe limit may be enforced by:
- Cloudflare,
- your hosting provider,
- a WordPress security plugin,
- an API service,
- a reverse proxy,
- a login protection system,
- or custom application code.
This means WordPress itself may not be the system generating the 429 response.
1. Stop Repeated Refreshes and Wait Before Retrying
If you receive HTTP 429, do not immediately keep refreshing the page.
Repeated requests can extend or retrigger the rate limit.
Wait a few minutes and retry once.
Some services also return a header such as:
Retry-AfterThis can tell the client how long to wait before sending another request.
If the response includes:
Retry-After: 60the client should generally wait approximately 60 seconds before retrying.
Respecting the limit is especially important for:
- REST API clients,
- webhooks,
- automation tools,
- crawlers,
- and WooCommerce integrations.
2. Find the Exact Request Returning 429
Use browser developer tools to identify the failing request.
In Chrome or Edge, press:
F12Open:
Network
Then reproduce the problem.
Look for:
429 Too Many RequestsCheck:
- Request URL,
- Request Method,
- Response Headers,
- Response body,
- Initiator,
- and any
Retry-Afterheader.
You may discover that only one endpoint is being rate-limited, such as:
/wp-login.phpor:
/wp-json/or:
/wp-admin/admin-ajax.phpIf only one endpoint fails, focus on the traffic hitting that endpoint.
3. Check Cloudflare Rate Limiting and Security Events
If your website uses Cloudflare, inspect:
- Security Events,
- WAF custom rules,
- rate limiting rules,
- bot protection,
- Managed Challenge rules,
- and IP reputation actions.
Reproduce the 429 once and note the exact time.
Then check whether Cloudflare blocked or limited the request.
Pay attention to:
- the source IP,
- the URL,
- the triggered rule,
- and the action applied.
If a legitimate WordPress administrator request is hitting a rate-limit rule, create the narrowest safe exception.
Do not disable all Cloudflare protection simply to remove a 429 error.
4. Check WordPress Security and Login Protection Plugins
Security plugins often limit repeated requests.
This is especially common for:
- login attempts,
- XML-RPC traffic,
- REST API access,
- password reset requests,
- and suspicious bots.
Check settings related to:
- brute-force protection,
- rate limiting,
- IP blocking,
- temporary lockouts,
- request throttling,
- and bot protection.
If your own IP is temporarily locked, use the plugin’s normal unlock or allowlist process.
Do not permanently turn off brute-force protection.
If login protection is too aggressive for legitimate administrators, adjust:
- the number of allowed attempts,
- lockout duration,
- or trusted administrator IP rules.
5. Check Bots, Crawlers, and Suspicious Traffic
A sudden increase in automated traffic can cause a WordPress site to hit rate limits.
Review:
- Cloudflare analytics,
- hosting access logs,
- security-plugin logs,
- Google Analytics traffic patterns,
- and server resource graphs.
Look for repeated requests to:
/wp-login.php
/xmlrpc.php
/wp-json/
/wp-admin/admin-ajax.phpor unusual query-string URLs.
Also check for:
- one IP generating thousands of requests,
- many requests from data centers,
- scrapers,
- bad bots,
- or repeated failed logins.
Use CDN or firewall controls to block clearly abusive traffic.
A targeted block is better than blocking entire countries or legitimate search engines without evidence.
6. Reduce REST API, AJAX, and Heartbeat Requests
WordPress and plugins can generate frequent background requests.
Common endpoints include:
/wp-json/and:
/wp-admin/admin-ajax.phpThe WordPress Heartbeat API can also generate periodic requests while wp-admin is open.
Problems may occur when:
- many admin tabs are open,
- a plugin polls every few seconds,
- a dashboard widget makes constant API calls,
- or multiple integrations use the REST API simultaneously.
Use the browser Network panel to see whether one request repeats constantly.
If a plugin is polling excessively, look for settings such as:
- polling interval,
- sync frequency,
- refresh frequency,
- background updates,
- or heartbeat control.
Increase the interval when appropriate instead of disabling background functionality completely.
7. Check External API Quotas and Plugin Integrations
A WordPress plugin may display or relay HTTP 429 from an external service.
Examples include:
- AI APIs,
- email services,
- shipping APIs,
- payment providers,
- SEO APIs,
- translation services,
- CRM systems,
- social media APIs,
- and map services.
If the response comes from an external API, check that service’s:
- request quota,
- requests-per-minute limit,
- requests-per-day limit,
- account plan,
- and retry policy.
The correct fix may be:
- slowing requests,
- batching requests,
- caching API results,
- waiting for the quota to reset,
- or increasing the API plan.
Do not create an infinite retry loop when an API returns 429.
8. Review Hosting Limits and Server Logs
Your hosting provider may enforce request limits independently of WordPress.
Check the hosting dashboard for:
- CPU usage,
- entry processes,
- concurrent connections,
- PHP worker usage,
- request limits,
- and firewall events.
Review:
- Apache logs,
- Nginx logs,
- hosting security logs,
- PHP logs,
- and reverse-proxy logs.
If contacting support, provide:
- the exact URL returning 429,
- the time of the request,
- your IP address if requested,
- whether Cloudflare is enabled,
- and whether the problem affects all visitors or only one IP.
Ask whether the hosting platform is enforcing:
- request throttling,
- connection limits,
- bot protection,
- or temporary IP rate limits.
Why Does WordPress Login Show 429 Too Many Requests?
This commonly happens because brute-force protection has detected too many login attempts.
Possible causes include:
- incorrect password attempts,
- bots attacking
wp-login.php, - password managers submitting repeatedly,
- or a security plugin with aggressive lockout settings.
Check your security-plugin logs before disabling anything.
If your IP is blocked, use the normal unlock process.
Also make sure the repeated attempts are not actually malicious traffic.
Why Does wp-admin Return HTTP 429?
wp-admin can generate many background requests when multiple editor tabs are open.
Plugins may also constantly refresh:
- analytics,
- orders,
- security data,
- notifications,
- and synchronization status.
Close unnecessary admin tabs and use the Network panel to identify repeating requests.
If one plugin generates dozens of requests per minute, test that plugin first.
Why Does admin-ajax.php Return 429?
admin-ajax.php is used by WordPress and many plugins for background actions.
A poorly configured plugin can call it excessively.
Check the request’s:
- Initiator,
- Form Data,
- action parameter,
- and frequency.
If one AJAX action repeats every second or two, determine which plugin owns that action.
Why Does the REST API Return 429?
REST API traffic can be rate-limited by:
- Cloudflare,
- a security plugin,
- your host,
- or custom API middleware.
External applications can also generate excessive API traffic.
Check whether the same client repeatedly requests:
/wp-json/or a plugin-specific route.
If the REST API is failing for reasons other than rate limiting, see our WordPress REST API Error? 8 Fixes guide.
Why Does WooCommerce Return 429?
WooCommerce can generate significant API and AJAX traffic.
Possible sources include:
- inventory synchronization,
- order syncing,
- payment gateways,
- shipping integrations,
- webhooks,
- and third-party ERP systems.
If one external system requests WooCommerce data too frequently, both WordPress and the remote service may hit rate limits.
Reduce synchronization frequency or batch multiple updates where supported.
429 Too Many Requests vs 403 Forbidden
These errors can both block access but mean different things.
429 Too Many Requests: access is temporarily limited because request volume is too high.
403 Forbidden: the server refuses access regardless of request rate.
If WordPress returns 403, see our WordPress 403 Forbidden Error? 8 Fixes guide.
429 vs 408 Request Timeout
408 Request Timeout: the server waited too long for a client request to complete.
429 Too Many Requests: the client sent requests too frequently.
A useful simplified comparison is:
408 = request too slow
429 = requests too frequentIf your server returns 408, see our WordPress 408 Request Timeout Error? 8 Fixes guide.
429 vs 503 Service Unavailable
A 503 response usually indicates that the server or application cannot currently handle the request.
A 429 response specifically indicates rate limiting.
Heavy traffic can potentially contribute to both, but they should be diagnosed differently.
If WordPress returns 503, see our WordPress 503 Service Unavailable? 8 Fixes guide.
Can Cloudflare Cause WordPress 429 Errors?
Yes.
Cloudflare can rate-limit traffic through custom rules, WAF configuration, bot management, or other security controls.
Check Security Events at the time of the error.
If a legitimate administrator is being limited, create a narrow exception.
If abusive traffic is being limited correctly, keep the protection in place.
Can Googlebot Trigger a Rate Limit?
A legitimate search crawler can generate many requests, especially on large sites.
However, do not immediately block Googlebot based only on a user-agent string.
Malicious bots can impersonate search engines.
If crawler traffic appears responsible:
- verify legitimate bot traffic,
- check crawl patterns,
- improve caching,
- and review rate-limit rules.
Avoid accidentally blocking important search-engine crawling.
Can a Plugin Cause 429 Errors?
Yes.
A plugin may:
- poll an API too frequently,
- retry failed requests endlessly,
- send repeated AJAX calls,
- create excessive webhooks,
- or repeatedly request an external service.
If the problem started immediately after installing or updating a plugin, monitor its network activity.
Temporarily disable it if safe and test whether the 429 stops.
Can Cron Jobs Cause Too Many Requests?
Yes.
A badly configured cron job can trigger WordPress or external APIs far too frequently.
Check:
- WP-Cron events,
- server cron jobs,
- plugin sync schedules,
- backup schedules,
- and webhook retry schedules.
An hourly job accidentally configured to run every minute can rapidly hit a rate limit.
Should You Increase the Rate Limit?
Sometimes, but only after understanding the traffic.
If legitimate normal traffic consistently exceeds an overly low threshold, increasing the limit can be appropriate.
If bots or broken code are generating excessive traffic, increasing the threshold merely postpones the problem.
First determine:
- who is sending the requests,
- which URL they target,
- how often requests occur,
- and whether that behavior is legitimate.
What Is the Retry-After Header?
A 429 response may include:
Retry-AfterThis header tells a client when it should attempt the request again.
For example:
Retry-After: 120may mean wait approximately two minutes.
API clients and automation tools should respect this value rather than immediately retrying.
Why Did 429 Start After Moving WordPress?
Your new host may use different:
- rate limits,
- firewall policies,
- bot protection,
- concurrent connection limits,
- or Cloudflare configuration.
Compare the old and new hosting security policies.
If normal traffic triggers 429 on the new server, ask support which rate-limit rule is responsible.
How to Prevent Future WordPress 429 Errors
After fixing the issue, reduce the chance of another rate-limit problem:
- Block abusive bots.
- Keep login brute-force protection enabled.
- Reduce unnecessary AJAX polling.
- Limit API request frequency.
- Cache external API responses.
- Batch synchronization jobs.
- Respect API retry headers.
- Monitor cron schedules.
- Use CDN caching for public content.
- Review security logs regularly.
Final Checklist
If WordPress returns 429 Too Many Requests, work through these steps:
- Stop repeated refreshes and wait before retrying.
- Identify the exact 429 request in the Network panel.
- Check Cloudflare rate limits and security events.
- Review WordPress security and login protection plugins.
- Check bots, crawlers, and suspicious traffic.
- Reduce excessive REST API, AJAX, or Heartbeat requests.
- Check external API quotas and plugin integrations.
- Review hosting rate limits and server logs.
A WordPress 429 error is usually a signal that one system is protecting itself from excessive request volume. Find the source of those requests and the layer enforcing the limit, then reduce abusive or unnecessary traffic instead of simply removing all rate limiting.