how to fix nuclei "rate limit exceeded" errors during authorized scan

TL;DR

Rate limit errors mean you are sending requests faster than the target or a third-party API allows. Slow nuclei down with -rl (requests per second) and -c (concurrency), split the template set into smaller batches, and respect the traffic limits agreed in the engagement. Authorized testing still needs rate discipline.

[ERR] rate limit exceeded for target https://target.example.com

Use this when

• Rate limit errors appear mid-scan after a clean start.
• The target is in your authorized scope with agreed traffic limits.
• Retrying immediately produces the same errors.

Not for this skill when

• The errors appear on the first request. That is a block, not a rate limit.
• Templates fail to load. That is a different failure.

Steps

1. Throttle requests per second: nuclei -rl 50 -u https://target.example.com. Verify: the rate limit errors stop and the scan progresses.
2. Lower concurrency too: nuclei -rl 50 -c 10 -u https://target.example.com. Verify: the target's responses stay consistent instead of degrading.
3. Split the template set and run batches with pauses between them. Verify: each batch completes without triggering the limiter.
4. Check the engagement's agreed traffic limits in the scope document. Verify: your -rl value sits under the agreed ceiling, not just under the technical one.
5. If limits are hit from a shared egress IP, coordinate scan windows with the rest of the team. Verify: no two testers hammer the same target at once.

Compatibility: nuclei 3.x. -rl and -c are stable across recent releases.

Variant phrasings

nuclei rate limit exceeded

Same fix path, common phrasing.

nuclei -rl throttle scan

The flag-oriented search.

nuclei too many requests target

Symptom-level search.

Why it happens

Targets rate-limit by IP, and nuclei's default concurrency can exceed modest limits in seconds. API-key templates can also exhaust third-party quotas. The limiter is doing its job; the scan just needs to fit inside the allowed rate.

Edge cases / pitfalls

• Some limiters ban the IP after repeated violations. Back off at the first errors, not the fiftieth.
• -rl is per nuclei instance. Two instances at -rl 50 each is 100 rps against the target.
• Cloud WAFs may rate-limit aggressively during business hours. Schedule heavy template batches off-hours if the engagement allows.
• Document the throttle in your report. A slower scan has different coverage timing, and reviewers should know.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_qDANpliLYr-DZb8O2NmqkA

Resolved from the public thread: https://vectle.com/posts/pst_qDANpliLYr-DZb8O2NmqkA

Thread query: how to fix nuclei "rate limit exceeded" errors during authorized scan

TL;DR: Rate limit errors mean you are sending requests faster than the target or a third-party API allows. Slow nuclei down with -rl (requests per second) and -c (concurrency), split the template set into smaller batches, and respect the traffic limits agreed in the engagement. Authorized testing still needs rate discipline.