WordPress 429 Too Many Requests: Fix the Rate Limit (2026)

A 429 is your server slamming the door on excess requests. Something - a bot, a plugin, or a misconfigured cron - is hammering it past the allowed rate. The fix isn't "wait"; it's finding what's making all those requests and shutting it down. Six steps, in order.

1. Identify What's Hammering

The access log names the culprit. In cPanel > Metrics > Raw Access, look for repeating patterns:

• -Hundreds of POSTs to wp-login.php or xmlrpc.php from rotating IPs = brute force (fix 3)
• -Requests to the same URL every few seconds = a plugin polling something (fix 2)
• -Hits from a single user-agent like "AhrefsBot" or "GPTBot" nonstop = crawler abuse (fix 5)

2. Deactivate Plugins

Plugins that call external APIs on every page load - rank trackers, social feeds, some analytics dashboards - trip rate limits fast. Rename wp-content/plugins to plugins_off via FTP, retest, then reactivate one by one. Also check for a runaway cron event: install WP Crontrol and look for a job scheduled every minute that never completes.

3. Lock Down wp-login and XML-RPC

Brute force on wp-login.php is the most common external cause. Three defenses, stack them:

1. 1.Install a login limiter (Limit Login Attempts Reloaded) - 4 attempts then lockout
2. 2.Restrict wp-login.php by IP in .htaccess if you have a static IP:
   <Files wp-login.php> Require ip YOUR.IP.HERE </Files>
3. 3.Disable XML-RPC unless something needs it - add to functions.php:
   add_filter('xmlrpc_enabled', '__return_false');

4. Check Your CDN and Security Rules

Cloudflare Rate Limiting or a security plugin's firewall can 429 legitimate traffic - including you. In Cloudflare: Security > WAF > Rate Limiting Rules; temporarily lower sensitivity or pause the rule to test. Same check in Wordfence/iThemes: the live traffic log shows exactly what got blocked and why.

5. Tame wp-cron and Crawlers

wp-cron fires on every pageview - under a crawler storm, it multiplies requests. Convert it to a real server cron (instructions here) so cron runs on a schedule, not on every hit. For abusive crawlers: throttle in robots.txt with Crawl-delay for polite bots, block the impolite ones by user-agent in your firewall.

6. When the Limit Is Just Too Low

If the 429s fire under normal traffic - admin work, a few editors saving posts - your host's rate limit is undersized for a real site. Ask support for the exact threshold (requests per minute and per IP). If the answer is "tight limits are our security model," that's a plan limitation, not a bug to fix.

Related: 403 forbidden error - hacked site recovery - 502 bad gateway fix - security checklist.