Choose limits from the endpoint's job
A public search route, login form, and private data endpoint have different risks. Set limits around the cost and abuse potential of each action instead of applying one unexplained number everywhere.
Use account, token, or network identity carefully. Shared office and mobile networks can put many legitimate people behind one IP address.
Return a response clients can handle
When a client exceeds its limit, return an appropriate status and a small message that explains when it can try again. Include a retry hint when your infrastructure supports it.
Make the UI preserve the user's work and avoid automatic retries that add more traffic to an already busy service.
Use shared storage in production
An in-memory counter works only inside one process. If an application runs on several instances or serverless functions, use a shared store or a platform-level control that all instances can see.
Monitor blocked requests and review false positives after release. Keep stricter controls on sensitive actions and document how legitimate clients should behave.