Your deployed Replit app shows Rate exceeded (429) to visitors

You built and deployed an app on Replit. It worked for weeks. Then visitors started seeing a bare page that says Rate exceeded with a 429 status, sometimes intermittently, sometimes for everyone. You did not add rate limiting. Your code did not change. That is because the error is not coming from your code at all.

The key insight: it is Replit's edge, not your app

A bare Rate exceeded page with a 429 status comes from Replit's edge infrastructure, sitting in front of your deployment. Your app never even saw the request. Two tell-tales confirm it: the response is plain text or a bare error page with none of your app's HTML, and nothing appears in your app's logs for those requests. If either is true, stop debugging your code.

Why this happens to AI built apps specifically

Replit Autoscale deployments have per-deployment settings for machine power and how many machines can run. The defaults are sized for hobby traffic, and AI builders never touch them. The moment the site gets real traffic, the edge starts shedding requests with 429 before they ever reach the app. It does not even take real users: in 2026, anything content shaped like a news site gets hammered by AI scrapers and bots, and that traffic alone can push a default-sized deployment over its limit.

Confirm it in two minutes

1. Open the failing URL, press F12 for devtools, and check the Network tab. Look at the 429 response body and headers. No app HTML in the body means edge, not app.
2. Open your deployment logs in Replit. The 429ed requests are absent. Your app cannot log requests it never received.
3. Open your Autoscale deployment settings and note the machine size and max machine count. If they are still at defaults, you have found it.

The fix

Raise the Autoscale machine settings in your deployment configuration: bump the machine power and the max machine count, then redeploy. In a real case from August 2026, scaling the machines up stopped the 429s immediately, no code changes at all. The tradeoff is real: bigger machines and more of them raise your Replit bill, which is why you should pair this with the next step.

Strongly recommended: put free Cloudflare in front

Point your own domain at the deployment through Cloudflare's free tier. You get three things Replit does not give you:

• Your own edge logs. You can finally see who is hammering the site, instead of guessing from a bill.
• Caching. Repeat traffic gets served from Cloudflare and never hits Replit at all, which lowers the autoscale bill you just raised.
• Bot filtering. Block or challenge AI scrapers and bad bots before they count against your deployment.

It also makes your app portable. The domain is yours, not Replit's, so if you ever move hosts, your visitors and your search rankings come with you.

Do not do this

Do not spend hours adding rate-limiting middleware or retry logic to your app code. The requests never reach your code, so nothing you write there can help. And do not assume it is a Replit outage and sit in the support queue; support is slow, and this is almost always your deployment settings, which you can check and change yourself in minutes.

Still stuck?