how to fix nuclei "rate limit exceeded" errors during authorized scan
Fixes nuclei rate-limit errors on an authorized scan: throttling with -rl and -c, staggering template batches, and staying inside the engagement's agreed traffic limits. Use when the target or an API starts refusing requests mid-scan. Not for load errors before scanning.
TL;DR
Rate limit errors mean you are sending requests faster than the target or a third-party API allows. Slow nuclei down with -rl (requests per second) and -c (concurrency), split the template set into smaller batches, and respect the traffic limits agreed in the engagement. Authorized testing still needs rate discipline.
[ERR] rate limit exceeded for target https://target.example.comUse this when
- Rate limit errors appear mid-scan after a clean start.
- The target is in your authorized scope with agreed traffic limits.
- Retrying immediately produces the same errors.
Not for this skill when
- The errors appear on the first request. That is a block, not a rate limit.
- Templates fail to load. That is a different failure.
Steps
- Throttle requests per second:
nuclei -rl 50 -u https://target.example.com. Verify: the rate limit errors stop and the scan progresses. - Lower concurrency too:
nuclei -rl 50 -c 10 -u https://target.example.com. Verify: the target's responses stay consistent instead of degrading. - Split the template set and run batches with pauses between them. Verify: each batch completes without triggering the limiter.
- Check the engagement's agreed traffic limits in the scope document. Verify: your -rl value sits under the agreed ceiling, not just under the technical one.
- If limits are hit from a shared egress IP, coordinate scan windows with the rest of the team. Verify: no two testers hammer the same target at once.
Compatibility: nuclei 3.x. -rl and -c are stable across recent releases.
Variant phrasings
nuclei rate limit exceeded
Same fix path, common phrasing.
nuclei -rl throttle scan
The flag-oriented search.
nuclei too many requests target
Symptom-level search.
Why it happens
Targets rate-limit by IP, and nuclei's default concurrency can exceed modest limits in seconds. API-key templates can also exhaust third-party quotas. The limiter is doing its job; the scan just needs to fit inside the allowed rate.
Edge cases / pitfalls
- Some limiters ban the IP after repeated violations. Back off at the first errors, not the fiftieth.
- -rl is per nuclei instance. Two instances at -rl 50 each is 100 rps against the target.
- Cloud WAFs may rate-limit aggressively during business hours. Schedule heavy template batches off-hours if the engagement allows.
- Document the throttle in your report. A slower scan has different coverage timing, and reviewers should know.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_qDANpliLYr-DZb8O2NmqkA