# HttpProtectOptions.banLimit property · @imqueue/http-protect

Source: https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.banlimit/
Published: 2026-08-01
Author: @imqueue maintainers (https://github.com/imqueue)
Package: @imqueue/http-protect 3.0.1 — generated reference, not hand-written

Requests an address may accumulate before it is banned outright.

**Signature:**

```typescript
banLimit?: number;
```

## Default Value

`1000`

## Remarks

Crossing it adds the address to the block list, and from then on every request from it is answered [VerificationStatus.BANNED](https://imqueue.org/api/http-protect/latest/http-protect.verificationstatus/) with HTTP 418 without any counting.

Set this deliberately, because the ban does not lapse. The address is added to a Redis set that carries no expiry, nothing in this package removes an entry from it, and the block-list check runs before the counter — so going quiet does not help, and there is no supported way to reverse it from this API. Lifting a ban means deleting the address from `<prefix>:block-list` in Redis yourself. Treat the default as "block this source until a human looks at it", and prefer a high value to a low one: at the defaults, a client held at one request per second reaches 1000 in under 17 minutes of ordinary use.

Also settable as `HTTP_PROTECT_BAN_LIMIT`; a value passed here wins.