Why rate limits are hard to set
Set a rate limit too low and you block real users during normal traffic spikes. Set it too high and it does nothing against a real attack. A good starting point comes from your actual traffic data, not a guess — this calculator will help you turn observed request volume into a reasonable per-IP or per-endpoint threshold.