Skip to main content

❓429 — Scanner rate limited

Find out how to clear a 429 scan error.

429 — Your Site Is Rate-Limiting Our Scanner

What's happening

When we tried to scan your site, your security tool slowed our scanner down because it detected too many requests in a short period of time. As a result, the scan couldn't finish.

This is closely related to a 403 error. The difference is that instead of completely blocking our scanner, your security layer is throttling or rate-limiting it.

This commonly happens with tools like Cloudflare, Wordfence, Sucuri, and other firewalls, bot protection tools, or hosting security layers.

The fix

The solution is the same as for a 403 error: configure your security tool to trust our scanner traffic so it isn't rate-limited.

Our platform does this using a custom authentication header, not by allowlisting IP addresses.

You'll need to:

  • Log in to your AccessibilityChecker.org account.

  • Navigate to the Domain Settings section.

  • Click on Advanced Settings.

  • Scroll to the Custom Headers section.

  • You will now see a custom Header name and Header value field, which you will need to complete. For Shopify customers, you have the ability to add multiple custom headers, which is a requirement for your setup. More here.

Example:

  • Header name (use a non-standard header): X-MyScanner-Auth

  • Header value (random, hard-to-guess): 7f3b9e2a-4c1d-4d2b-9f6e-1a2b3c4d5e6f

Other formats that work:

  • Name: X-Custom-Access

  • Value: scanner-access--2025-09-26--R4nd0m

Tips:

  • Use a header name that starts with X- or is clearly custom to avoid conflicts.

  • Make the value long and random (UUID or cryptographic token).

  • Don’t use sensitive personal info in the header value.

You will now need to add these exact values to your security platform so requests containing the header bypass security checks.

The exact setup steps depend on which security tool you're using.

If you're using Cloudflare

Cloudflare's rate limiting, Bot Fight Mode, and WAF protections are one of the most common causes of 429 errors during scans.

How to allow our scanner through

  1. Log in to your Cloudflare dashboard and select the domain we're scanning

  2. Go to Security → WAF → Custom rules

  3. Click Create rule

  4. Set the rule name to something clear like:

    • Allow AccessibilityChecker scanner

  5. Under When incoming requests match:

    • Choose Field → HTTP Request Header

    • Enter the Header Name from your AccessibilityChecker.org dashboard

    • Set the operator to equals

    • Paste the Header Value from your dashboard

  6. Under Then take action, select:

    • Skip

  7. Tick all relevant WAF/security components

  8. Click Deploy

Important note

Cloudflare applies some security checks before custom rules, especially on Free, Pro, and Business plans. If you've configured the rule correctly and still receive 429 errors, this may be why.

If you're using Wordfence (WordPress)

Wordfence commonly triggers 429 errors through its rate limiting and brute-force protection settings.

How to allow our scanner through

Because Wordfence doesn't provide a simple custom header allowlist feature in the UI, the easiest approach is to create a rule or exclusion based on the custom request header.

  1. In your WordPress admin, go to:

    • Wordfence → Firewall → All Firewall Options

  2. Look for:

    • rate limiting

    • allowlisted services

    • request exclusions

    • or advanced firewall rules

  3. Create a bypass or exclusion rule using:

    • the custom Header Name

    • and matching Header Value

  4. Save your changes

Also check rate limiting settings

Go to:

  • Wordfence → Firewall → All Firewall Options → Rate Limiting

Make sure requests containing the custom header are not being throttled or blocked.

Open Wordfence - All Firewall Options

If you're using Sucuri

Sucuri can trigger 429 errors when its WAF or anti-bot protections detect high request volume.

How to allow our scanner through

  1. Log in to your Sucuri dashboard

  2. Select the site we're scanning

  3. Go to:

    • Settings → Security

    • or Access Control

  4. Create a custom bypass or allow rule based on a request header

  5. Configure the rule using:

    • the Header Name from your AccessibilityChecker dashboard

    • the Header Value from your dashboard

  6. Save and deploy the rule

Setting HTTP security headers in Sucuri

If you're using AWS WAF

AWS WAF rate-based rules can block or throttle scanners when many requests are sent quickly.

How to allow our scanner through

  1. Open the AWS WAF Console

  2. Open the Web ACL protecting the site we're scanning

  3. Add a new custom rule

  4. Configure the rule to:

    • inspect a Single Header

    • match the Header Name from your AccessibilityChecker dashboard

    • and the matching Header Value

  5. Set the rule action to:

    • Allow

  6. Move the rule above any rate-based or blocking rules

  7. Save and deploy

Figure 10: Console screenshot configuring a custom response body for a rule

If you're using Shopify

Shopify uses Web Bot Auth to let merchants securely authorize crawlers, scripts, or tools to access their public Shopify online store.

To create a custom header in Shopify:

  1. Login to your Shopify store and go to to Online Store > Preferences under Shopify admin

  2. Find the Crawler access section and click on Create signature.

  3. Give the signature a name, select the domain, and set an expiration period (up to 3 months)

  4. Copy all three Signature-Input and Signature values

These are the values you will need:

Header Name

Value

Signature-Input

(copied from Shopify admin)

Signature

(copied from Shopify admin)

Signature-Agent

"https://shopify.com"

To add your custom headers to AccessibilityChecker.org:

  1. Login to your AccessibilityChecker.org dashboard

  2. Click on the kebab menu to access Domain Settings

  3. Click on Advanced Settings and scroll down to Custom Request Headers

  4. Click on Add Header three times to insert all of the required Header Names and Values

  5. Click on Update Domain

If you're using something else

If your firewall or security platform isn't listed above, look for settings related to:

  • rate limiting

  • request throttling

  • bot protection

  • request filtering

  • firewall bypass rules

Then create a rule that trusts requests containing:

  • the custom Header Name

  • and matching Header Value

The rule action should be something like:

  • Allow

  • Skip

  • Bypass

  • Trust request

You can find the required header details in your AccessibilityChecker dashboard under:

  • Domain Settings

Common other tools where this works

  • Imperva

  • Akamai Technologies

  • Fastly

  • Bunny.net

  • ModSecurity

  • Hosting provider firewalls

  • Reverse proxies and load balancers

Still not working?

Our team has already been notified about the 429 error on your domain and will help you work through it step by step.

If you've already configured the custom header rule and are still seeing this error, reply to the error email you received with:

  • a screenshot of your security platform settings

  • the rule you've configured

  • any remaining error messages

We'll help you pinpoint exactly what's still causing the rate limiting.

Related Articles
🧩 Adding Custom Headers for Restricted Environments
❌ Fixing Common Errors
❓403 — Site Blocking Scanner
❓403 — Your sitemap is blocking our tool
Did this answer your question?