Limit the action, not the person

Failed logins, password resets and contact forms deserve tight limits. Reading pages does not. A single global limit inevitably throttles a legitimate busy user.

Choose the key carefully

IP address is imperfect — offices and mobile networks share addresses. Combining IP with account or session gives a fairer signal.

Fail informatively

Tell the user how long to wait. A silent rejection looks like a broken site and produces a support ticket instead of a retry.