API Rate Limiting Check: What StackShield Tests

What this check looks for

StackShield sends bursts of requests to your API endpoints and watches whether the application throttles them. It is looking for the 429 Too Many Requests response, or the RateLimit headers that indicate a limiter is in place, versus an endpoint that answers every request at full speed no matter how many arrive.

Why it matters

An API without rate limiting is an API an attacker can use as fast as their connection allows. That enables several distinct abuses: brute forcing credentials or tokens, scraping data at scale, enumerating resources by walking IDs, and exhausting your resources or third-party API budgets through sheer volume.

Rate limiting is also a cost-control measure. An unthrottled endpoint that calls a paid downstream service, an LLM, an SMS gateway, a geocoder, lets an attacker run up your bill as a side effect of abusing it.

What a failed check means

A failed check means an endpoint accepted a high-rate burst without throttling. It is not evidence of an attack, it is the absence of the control that makes most automated attacks uneconomic. On a public API, that absence is usually the highest-leverage thing to fix.

The fix is Laravel's rate limiter applied per route group, keyed appropriately by user, token or IP, with limits that fit legitimate use.

See the step-by-step remediation: how to fix this.