HttpProtectOptions.banLimit property

Requests an address may accumulate before it is banned outright.

Signature:

banLimit?: number;

Default Value

1000

Remarks

Crossing it adds the address to the block list, and from then on every request from it is answered VerificationStatus.BANNED with HTTP 418 without any counting.

Set this deliberately, because the ban does not lapse. The address is added to a Redis set that carries no expiry, nothing in this package removes an entry from it, and the block-list check runs before the counter — so going quiet does not help, and there is no supported way to reverse it from this API. Lifting a ban means deleting the address from <prefix>:block-list in Redis yourself. Treat the default as "block this source until a human looks at it", and prefer a high value to a low one: at the defaults, a client held at one request per second reaches 1000 in under 17 minutes of ordinary use.

Also settable as HTTP_PROTECT_BAN_LIMIT; a value passed here wins.

Read this page as plain markdown — no HTML, no navigation. For pasting into an LLM, or for an agent to fetch.