Rate limiting restricts how often an action may occur within a time window. It protects endpoints such as login, password reset, search, and public APIs from brute-force attempts, accidental overload, and abusive automation.

Laravel’s rate limiter uses the configured cache store to track attempts. Define named limiters with Rate::for and Limit rules that can vary by authenticated user, IP address, route, or another stable key, then apply the throttle middleware to routes. A good limiter returns a clear retry response and is designed around the endpoint’s risk and normal usage rather than a single arbitrary number.