I got cloudflare but I launch an actual seo campaign for it a paid one.
Found the fix!
The live site is behind Cloudflare, so a 429 could come from Cloudflare, the host, or the app. I'm checking the app's own rate limiters next and will make them diagnosable.
I found two real bugs in the app's own rate limiting that I've fixed:
Shared counter: the throttle:N,M routes (login, register, password reset, checkout, ad clicks and others) all drew from one counter per visitor. In a test, six failed logins made the next register attempt return 429. Each endpoint now has its own limiter.
Contact form:
it counted every submission twice, so only 2 of the intended 3 per minute got through, and the daily cap never applied.
The app also gave you no way to see what tripped:
429 page: the app now shows a styled 429 page ("Slow down a moment") in the site's look.
Logging:
every throttled request is now logged as "Rate limit hit" with the path, the limit that tripped, the IP and the user. It appears in ACP → Error log, once per IP, path and limit per minute so a flood can't fill the log.
Deploying the update now bare with me!
Check now and let me know gizmo? yeh?
Will be back up in a minitue
Back live