Rate limits & quotas

Two different limits can stop a submission, and they exist for different reasons: rate limiting is anti-abuse, and it's free to hit. The monthly quota is your plan's included allowance, and it's what you're paying for.

Rate limiting

Each endpoint has a rate limit — 20 requests per hour by default, adjustable per endpoint in Settings. It's enforced in two places at once, both using that same number:

• Per endpoint — total submissions to that one endpoint URL, from anyone.
• Per submitting IP address — so one visitor (or bot) can't eat the whole endpoint's allowance by themselves. IPv6 addresses are bucketed by their /64 prefix, since a single visitor can have many addresses within that range.

Whichever limit is hit first returns rate_limited (429). A request blocked here never reaches spam filtering or delivery, and — since it was never a submission that could have counted — it doesn't touch your monthly quota either.

Monthly quota

Your plan includes a fixed number of submissions per calendar month, resetting on the 1st. Only submissions that actually get processed count — a request blocked by rate limiting, the honeypot, or Turnstile never reaches the quota check, and a submission held by spam filtering doesn't count either, since nothing was delivered. An autoresponder reply, when enabled, counts as one additional unit.

Reaching your quota returns quota_exceeded (402). Paid plans allow a limited, metered amount of overage past the included quota before hard-blocking — the Free plan blocks right at its limit. See plans for exact numbers per tier.