Security, Abuse & Privacy

Upload Rate Limiting

Definition

Rate limiting counts events over time rather than bytes at rest. An upload limit might be expressed as a number of files per minute, a number of new sites per hour, or a volume of data per day, and the three are often enforced together. Limits usually apply per account and per IP address, so a shared office connection can hit one even when no individual has uploaded much. Exceeding a limit produces an HTTP 429 status, Too Many Requests, normally with a Retry-After header giving the seconds to wait. This is distinct from a file size limit, which rejects one oversized file, and from a storage quota, which refuses a file because the account is full.

Why It Matters

The limit is there because free hosting is attractive to scripts. Bulk-published throwaway pages are the shape most abuse takes, and a ceiling on publishing rate removes most of it without inconveniencing a person uploading a deck. Ordinary users meet it in three situations: migrating a large set of files at once, a CI job pushing on every commit, and a folder upload of a site with hundreds of small assets. In each case the fix is to slow down rather than to retry harder — a client that ignores 429 and hammers the endpoint usually gets a longer block than the one it was given. Building the wait into the script makes a migration that would fail take perhaps ten minutes longer.

How It Works

Most implementations use a token bucket: an account holds a number of tokens, each upload spends one, and tokens refill at a fixed rate, which allows a short burst and then a steady pace. The response headers tell you where you stand — commonly a limit, a remaining count and a reset timestamp, alongside Retry-After on the rejection itself. A well-behaved client reads Retry-After, sleeps, and retries with exponential backoff. Where a REST API is involved, limits are usually per API token rather than per session, so splitting work across tokens to go faster is both detectable and against most acceptable use policies. Large single files are handled differently: a chunked upload counts as one operation, not as one per part.

Real-World Example

An agency moves 400 client PDFs onto 99helpers with a script against the REST API. It runs flat out, hits 429 after the first few dozen, and the script treats the error as a failure and exits. Adding a read of Retry-After and a two-second pause between calls completes the whole set in under fifteen minutes, with no rejected files and nothing lost.

Common Mistakes

  • Retrying immediately after a 429 instead of honouring Retry-After — repeated ignored limits typically extend the block
  • Confusing the rate limit with the storage quota — one is about how fast you are publishing, the other about how much you are keeping
  • Spreading a job across several API tokens to move faster, which is treated as evasion rather than as clever engineering
  • Assuming a limit is per user when it is also applied per IP address, so an office or VPN shares one budget

Related Terms

Put a file online in seconds

Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.

Host a file free →