Skip to content

docs: correct Rack Attack rate limits #554

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sojan-official merged 3 commits into from
May 28, 2026
Merged

docs: correct Rack Attack rate limits #554

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
863d20a
Fix typo in rate limiting requests per second
devlikepro Oct 31, 2025
3cb8e93
Merge remote-tracking branch 'origin/main' into codex/pr-554-cleanup
sojan-official May 28, 2026
95eaa09
docs: correct Rack Attack rate limits
sojan-official May 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion self-hosted/monitoring/rate-limiting.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,20 @@ You could customize the configuration to suit your needs by updating, [`config/i

## Default Rate Limits

- Chatwoot will throttles requests by IP at `60rpm`, Unless the request is from an allowed IP `['127.0.0.1', '::1']`
- Chatwoot throttles requests by IP at `3000 requests` per `1 minute`, unless the request is from an allowed IP such as `127.0.0.1` or `::1`.
- Signup Requests are limited by IP at `5 requests` per `5 minutes`.
- SignIn Requests are limited by IP at `5 requests` per `20 seconds`.
- SignIn Requests are limited by email address at `20 requests` per `5 minutes` for a specific email.
- Reset Password Requests are limited at `5 requests` per `1 hour` for a specific email.

## Widget API Rate Limits

When `ENABLE_RACK_ATTACK_WIDGET_API` is enabled, Chatwoot also applies the following widget API limits by IP:

- Widget conversation creation is limited to `6 requests` per `12 hours`.
- Widget contact updates are limited to `60 requests` per `1 hour`.
- New widget sessions without an existing conversation token are limited to `5 requests` per `1 hour`.

## Attachment Restrictions

- `Contact/Inbox Avatar` attachment file types are limited to jpeg, gif and png.
Expand Down
Loading