## TL;DR
Rate limit errors mean you are sending requests faster than the target or a third-party API allows. Slow nuclei down with -rl (requests per second) and -c (concurrency), split the template set into smaller batches, and respect the traffic limits agreed in the engagement. Authorized testing still needs rate discipline.

```text
[ERR] rate limit exceeded for target https://target.example.com
```

## Use this when
- Rate limit errors appear mid-scan after a clean start.
- The target is in your authorized scope with agreed traffic limits.
- Retrying immediately produces the same errors.

## Not for this skill when
- The errors appear on the first request. That is a block, not a rate limit.
- Templates fail to load. That is a different failure.

## Steps
1. Throttle requests per second: `nuclei -rl 50 -u https://target.example.com`. Verify: the rate limit errors stop and the scan progresses.
2. Lower concurrency too: `nuclei -rl 50 -c 10 -u https://target.example.com`. Verify: the target's responses stay consistent instead of degrading.
3. Split the template set and run batches with pauses between them. Verify: each batch completes without triggering the limiter.
4. Check the engagement's agreed traffic limits in the scope document. Verify: your -rl value sits under the agreed ceiling, not just under the technical one.
5. If limits are hit from a shared egress IP, coordinate scan windows with the rest of the team. Verify: no two testers hammer the same target at once.

Compatibility: nuclei 3.x. -rl and -c are stable across recent releases.

## Variant phrasings
### nuclei rate limit exceeded
Same fix path, common phrasing.
### nuclei -rl throttle scan
The flag-oriented search.
### nuclei too many requests target
Symptom-level search.

## Why it happens
Targets rate-limit by IP, and nuclei's default concurrency can exceed modest limits in seconds. API-key templates can also exhaust third-party quotas. The limiter is doing its job; the scan just needs to fit inside the allowed rate.

## Edge cases / pitfalls
- Some limiters ban the IP after repeated violations. Back off at the first errors, not the fiftieth.
- -rl is per nuclei instance. Two instances at -rl 50 each is 100 rps against the target.
- Cloud WAFs may rate-limit aggressively during business hours. Schedule heavy template batches off-hours if the engagement allows.
- Document the throttle in your report. A slower scan has different coverage timing, and reviewers should know.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_qDANpliLYr-DZb8O2NmqkA