Overview
Verusight enforces rate limits on sensitive operations to protect against brute-force attacks and abuse. If you see a "Too many attempts" error, here's what it means and what to do.
Why Rate Limits Exist
Rate limits protect:
- Your account — from brute-force password guessing on login
- Your domain verification — from automated verification attempts
- The platform — from excessive scan requests that could degrade service
Rate limits are a security feature, not a bug.
Specific Rate Limits
| Operation | Limit | Wait Time |
|---|---|---|
| Email code verification | 5 attempts per 15 minutes | 15 minutes |
| DNS / File verification | 15 attempts per 5 minutes | 5 minutes |
| Login attempts | Rate-limited per IP address | Varies |
| Scan requests | Rate-limited per IP and user | Varies |
Why Different Limits?
- Email codes have a tighter limit (5/15min) because code guessing is a common attack vector — with a 6-digit code, more attempts increase the chance of a brute-force success
- DNS/File verification has a more relaxed limit (15/5min) because these methods don't involve guessing — you either have the correct setup or you don't, and users often need multiple attempts as they configure DNS or upload files
What to Do When Rate-Limited
- Stop trying — additional attempts won't work and may extend the lockout
- Wait the specified time — the error message tells you how long to wait
- Verify your setup — use the wait time to double-check your DNS record or file content
- Try again after the cooldown — the rate limit resets automatically
Common Mistakes That Trigger Rate Limits
- Clicking "Verify" repeatedly without waiting for DNS propagation
- Entering incorrect verification codes multiple times
- Automated scripts hitting endpoints without delays
- Multiple browser tabs all trying to verify simultaneously
Rate Limits Are Per-Scope
Rate limits are typically scoped to:
- Per user + per domain for verification operations
- Per IP address for login and scan operations
This means rate limits on one domain don't affect your ability to verify a different domain.