Quick limit with throttle:max,minutes

The fastest way to limit a route is the throttle middleware with two numbers: how many requests, per how many minutes.

          Route::post('/contact', [ContactController::class, 'send'])
              ->middleware('throttle:3,1');   // 3 requests per 1 minute
        

The fourth submission within a minute gets a 429 Too Many Requests. Logged-in users are counted by user ID; guests by IP address.

Define named limiters with RateLimiter::for

For anything more than a one-off, define a named limiter in AppServiceProvider. It's a closure that receives the request and returns a Limit.

          use Illuminate\Cache\RateLimiting\Limit;
          use Illuminate\Http\Request;
          use Illuminate\Support\Facades\RateLimiter;

          public function boot(): void
          {
              RateLimiter::for('comments', function (Request $request) {
                  return Limit::perMinute(5)->by($request->user()?->id ?: $request->ip());
              });

              RateLimiter::for('api', function (Request $request) {
                  return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
              });
          }
        

->by(...) sets the key. Other windows include Limit::perSecond(), perHour() and perDay().

Attach a named limiter with throttle:name

          Route::post('/posts/{post}/comments', [CommentController::class, 'store'])
              ->middleware(['auth', 'throttle:comments']);
        

          Route::middleware(['auth:sanctum', 'throttle:api'])->group(function () {
              Route::apiResource('posts', Api\PostController::class);
          });
        

API responses also include X-RateLimit-Limit and X-RateLimit-Remaining headers so well-behaved clients can pace themselves.

Smarter limits: per plan, multiple limits, custom responses

Because the limiter is just PHP, you can return different limits for different users, or several limits at once.

          RateLimiter::for('uploads', function (Request $request) {
              if ($request->user()?->isPro()) {
                  return Limit::none();
              }

              return [
                  Limit::perMinute(10)->by($request->user()?->id ?: $request->ip()),
                  Limit::perDay(100)->by($request->user()?->id ?: $request->ip()),
              ];
          });
        

Add ->response(fn () => response('Slow down!', 429)) to a Limit to customise what blocked clients see.

Throttle logins (already done for you)

The login code in Laravel's starter kits (Breeze and the newer kits) and in Fortify already limits failed attempts: 5 tries, keyed by email + IP, then a lockout with a "Too many login attempts. Please try again in N seconds." message. Here's the pattern, so you can use it in your own code:

          use Illuminate\Support\Facades\RateLimiter;
          use Illuminate\Support\Str;

          $key = Str::transliterate(Str::lower($this->input('email')) . '|' . $this->ip());

          if (RateLimiter::tooManyAttempts($key, 5)) {
              $seconds = RateLimiter::availableIn($key);
              throw ValidationException::withMessages([
                  'email' => "Too many login attempts. Try again in {$seconds} seconds.",
              ]);
          }

          if (! Auth::attempt($this->only('email', 'password'))) {
              RateLimiter::hit($key);             // count the failure (60s decay)
              throw ValidationException::withMessages(['email' => __('auth.failed')]);
          }

          RateLimiter::clear($key);               // success: reset the counter