> ## Documentation Index
> Fetch the complete documentation index at: https://testwebmcp.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Limits

> Rate limits and how to handle them.

All limits are per IP address.

| What | Limit |
| - | - |
| Starting a scan | 1 per 24 hours, shared with the website |
| Everything else | 60 requests per minute |

The website and the API share one daily scan: using it on either uses it up on both. Polling a scan every 2 seconds for its full minute takes about 30 requests.

A scan request rejected for another reason, like a bad URL or a full queue, doesn't use up your scan.

## Headers

`GET` responses, and scan requests that are accepted or rate-limited, include:

| Header | Meaning |
| - | - |
| `X-RateLimit-Limit` | Requests allowed in the window. |
| `X-RateLimit-Remaining` | Requests left. |
| `X-RateLimit-Reset` | When the window resets, as a Unix timestamp. |

## When you hit a limit

You get `429`, with a `Retry-After` header in seconds:

```json theme={"theme":"github-dark"}
{
  "error": "The free limit is 1 scan per 24 hours per IP address, shared with the website.",
  "retryAfterSeconds": 86400,
  "retryAfterHuman": "24 hours",
  "resetAt": "2026-09-24T23:33:06.413Z"
}
```

If the scan queue is full you get `503` instead, also with `Retry-After`. Check `GET /api/v1/quota` before starting a scan to avoid a wasted request.

## From a browser

The `GET` endpoints accept requests from any origin. Starting a scan doesn't: call `POST /api/v1/scan` from a server or script.

## Support

Questions, or want your site removed? Email [hi@aicortez.com](mailto:hi@aicortez.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.