Too many requests. Please try again later.

@primerpizza

This message comes from a login rate limiter that’s built in for security (defaults to 10 attempts per minute per visitor). On some hosting setups — behind a reverse proxy, load balancer, or CDN — the server sees every visitor as coming from the same IP address, so that limit ends up shared across all your visitors instead of being per-person. That would explain why it’s fine on your other sites but not this one, it likely comes down to how this particular host/CDN is configured.

A couple of things to try:

1. Increase the rate limit (quickest fix): In WordPress admin, go to the Secure Passkeys settings page and raise “Login Rate Limiting – Max Attempts” (default 10) and/or the “Window (minutes)” setting. This gives more headroom without touching any code.
2. Fix the underlying IP detection (if you’re behind a proxy/CDN), Could you confirm:
   – Is this site behind Cloudflare (or another proxy/CDN), or on a host with a load balancer in front of it?
   – Does the error happen on your very first login attempt, or only after a few tries?

If you are behind a proxy/CDN that properly forwards the real visitor IP, adding this to a site-specific plugin or your theme’s functions.php will make the rate limiter track visitors individually instead of by the shared proxy IP:

add_filter('secure_passkeys_trust_proxy_headers', '__return_true');
Note: only add that filter if you’re confident there’s a proxy/CDN in front of your site that sanitizes the forwarded-IP header.

@primerpizza Thanks for confirming.

That matches exactly what I suspected, since your site is behind Cloudflare, our server was seeing Cloudflare’s proxy IP instead of your visitors’ real IPs. That means the login rate limiter (10 attempts/minute by default) was being shared across everyone passing through that connection, not tracked per visitor — so it could already be “used up” by other traffic before your first attempt even happened. That also explains why it resolved itself shortly after: the limit window resets after 1 minute.

Cloudflare does forward the real visitor IP via the X-Forwarded-For header, so this is safe to fix. Add this to a site-specific plugin (or your theme’s functions.php):

add_filter('secure_passkeys_trust_proxy_headers', '__return_true');

That will make the plugin key rate limiting off your actual visitors’ IPs instead of Cloudflare’s, so a single visitor’s login attempts won’t get lumped in with everyone else’s traffic.