How to Fix “Error 429 Too Many Requests” in WordPress (Ultimate 2025 Guide)

If your WordPress website keeps showing “Error 429 Too Many Requests”, it means one thing:

Your server is receiving more requests than it can handle — either from real users, bots, plugins, API calls, or bad scripts.

This error frustrates visitors, hurts SEO rankings, and can temporarily shut your site down. The worst part?
429 errors often appear suddenly with no clear explanation.

But the good news?

In this complete guide, I’ll show you every proven way to fix the 429 Too Many Requests error in WordPress — permanently. Whether it’s caused by plugins, bots, themes, CDN settings, rate limits, or server protection rules, this tutorial will help you identify and fix it step-by-step.

Let’s begin.

What Causes Error 429 in WordPress?

The 429 error happens when a user (or script) sends too many requests to your server within a short period.

Common causes include:

1. Plugin or theme sending excessive requests

Some plugins repeatedly call APIs, send cron requests, or ping remote servers.

2. Bots or crawlers attacking your site

Search engine crawlers, AI bots, spam bots, or scrapers cause sudden request spikes.

3. Hosting provider rate-limits your requests

Many shared hosting plans have strict limits to protect resources.

4. Too many requests from a single IP

This includes admin panel usage, external APIs, or a misconfigured security plugin.

5. CDN (Cloudflare, BunnyCDN, etc.) blocking requests

Firewall or bot rules may detect traffic as suspicious.

6. Misconfigured .htaccess or server rules

Bad rewrite rules can loop requests and cause 429 errors instantly.

7. DDoS or brute-force attempts

Attackers hammer login pages or API endpoints.

Understanding the cause helps fix the issue quickly. Now let’s fix it step-by-step.

How to Fix “429 Too Many Requests” in WordPress — Step-by-Step

1. Disable and Re-enable Plugins (Most Common Fix)

The fastest way to identify the culprit is by testing plugins.

Step-by-step:

1. Login to WordPress admin

2. Go to Plugins → Installed Plugins

3. Disable all plugins

4. Reload your website

5. If the error disappears → a plugin is responsible

6. Enable plugins one by one

Look for plugins that:

• Connect to external services (API-heavy)

• Handle security

• Handle redirections

• SEO tools

• Backup plugins

• Cache plugins

If you can’t access wp-admin

Rename the plugins folder:

Then reload your site. If it works, one of the plugins caused the issue.

2. Check Security Plugins (They Often Cause 429 Errors)

Security plugins like:

• Wordfence

• Sucuri

• iThemes Security

• Jetpack Protect

• Cloudflare plugin

…can block requests that look suspicious.

Fix:

Open your security plugin → check:

• Brute force protection logs

• Firewall logs

• Rate limiting

• IP blocking

Whitelist your own IP.
Clear the firewall cache.

3. Fix Rate-Limiting on Cloudflare (or Disable Temporarily)

If you’re using Cloudflare, you may see this error due to firewall or bot protection.

Steps to fix:

1. Login to Cloudflare dashboard

2. Go to Security → Events

3. Check what Cloudflare is blocking

4. Add your server IP and your own IP to Whitelist

5. Turn off Bot Fight Mode temporarily

6. Go to Caching → Purge Everything

Optional Rule Fix (Cloudflare Page Rule)**

Add a rule:

This prevents Cloudflare from rate-limiting admin area requests.

4. Increase Server Limits (cURL, API Calls, PHP Workers)

Sometimes the server cannot handle requests due to low limits.

Ask your host to increase:

• PHP workers

• cURL timeout

• max connections

• rate-limit policies

• API request thresholds

If you use shared hosting, 429 errors often come from limited resources.
Upgrading to VPS or cloud hosting solves it permanently.

5. Block Bad Bots Using .htaccess

Bots often overload your server.

Add this code to .htaccess:

Block excessive requests from a single IP:

Replace IP as needed.

6. Fix WordPress Heartbeat API Overload

The Heartbeat API auto-saves content and keeps admin sessions alive.
If it overfires → 429 error appears.

Install the Heartbeat Control plugin and set:

• Dashboard: 60 seconds

• Posts/Page editing: 30 seconds

• Frontend: Disable

Or disable manually:

7. Repair or Reset .htaccess File

Incorrect rewrite rules can create request loops.

Reset .htaccess:

1. Open your hosting file manager

2. Edit .htaccess

3. Replace everything with:

Save → refresh your website.

8. Limit WordPress Login Attempts

Bots attacking /wp-login.php often cause 429 errors.

Install Limit Login Attempts Reloaded and set:

• Max retries: 3

• Lockout time: 15 minutes

• Notify admin: enabled

Optional firewall rule (Cloudflare):

9. Fix External API Calls Sending Too Many Requests

Some plugins send API calls to:

• Google

• Stripe

• PayPal

• OpenAI

• Facebook

• WooCommerce API

• Email SMTP providers

If these calls fail rate limits, 429 errors appear.

Fix:

• Reconnect API keys

• Check plugin logs

• Disable automatic cron-based API sync

Enable manual sync instead.

10. Disable XML-RPC (Common Target of Attacks)

XML-RPC allows external connections and is often abused by bots.

Disable it:

Or block via .htaccess:

11. Optimize Cron Jobs (If They’re Overloading Your Server)

Disable default WP cron:

Add this to wp-config.php:

Then set a real cron job at cPanel:

This prevents cron overload and reduces requests significantly.

12. Increase Server Resources (Final & Permanent Fix)

If your traffic is growing, your hosting must grow too.

Choose:

• LiteSpeed hosting

• VPS hosting

• Cloud hosting (DigitalOcean, Linode, Vultr, Google Cloud)

• Managed WordPress hosting

Low server limits = constant 429 errors.

How to Check Logs to Identify the Exact Cause

1. Check Hosting Error Logs

Inside cPanel → Errors

2. Check Cloudflare Firewall Logs

Security → Events

3. Check WordPress Debug Logs

Enable debugging:

Check file:

Final Thoughts: Fixing WordPress 429 Errors the Right Way

The 429 Too Many Requests error is annoying — but fixable.
Once you identify what’s triggering excessive requests, the solution becomes simple.

The main causes:
✔ Bots
✔ Plugins
✔ API calls
✔ Hosting limits
✔ Firewall or CDN rules
✔ Server misconfigurations

Apply the fixes in this guide and your site will become stable, faster, and secure — without disruption.

FAQs

1. What is the “429 Too Many Requests” error in WordPress?

It means your server is receiving more requests than it can process due to bots, scripts, plugins, or hosting limitations.

2. Does this error affect SEO?

Yes — if Googlebot gets blocked with 429 errors, your rankings can drop.

3. Can Cloudflare cause this issue?

Yes. Firewall rules, bot protection, or rate limiting can trigger 429 errors.

4. Can I fix 429 errors without coding?

Yes — most fixes involve adjusting plugins, hosting settings, or firewall rules.

5. Do shared hosting plans cause 429 errors?

Often yes, because they have strict rate limits and low resources.