Limit the action, not the person
Failed logins, password resets and contact forms deserve tight limits. Reading pages does not. A single global limit inevitably throttles a legitimate busy user.
Choose the key carefully
IP address is imperfect — offices and mobile networks share addresses. Combining IP with account or session gives a fairer signal.
Fail informatively
Tell the user how long to wait. A silent rejection looks like a broken site and produces a support ticket instead of a retry.