# Add rate limiting - Editor
In this guide we'll add simple Rate Limiting to a route. If you don't have one
ready, complete [Step 1](../setup-a-basic-gateway/local.mdx) first.
Rate Limiting is one of our most popular **policies** - you should never ship an
API without rate limiting because your customers or internal developers **will**
accidentally DoS your API; usually with a rogue `useEffect` call in React code.
:::info{title="What's a Policy?"}
[Policies](../../../articles/policies.mdx) are modules that can intercept and
transform an incoming request or outgoing response. Zuplo offers a wide range of
policies built-in (including rate limiting) to save you time. You can check out
[the full list](../../../articles/policies.mdx).
:::
Zuplo offers a programmable approach to rate limiting that allows you to vary
how rate limiting is applied for each customer or request.
In this example, we'll add a simple IP-based rate limiter, but you should also
explore [dynamic rate limiting](../dynamic-rate-limiting/local.mdx) to see the
full power of the world's best rate limiter.
1. Add the rate-limiting Policy
Open the local **Route Designer** at http://localhost:9100. If your gateway
isn't already running, start it from your project directory with
`npm run dev`.
Select your route and click **Add Policy** on the incoming request policies
section.
Search for the Rate Limiting policy (not the "Complex" one) and click it.
By default, the policy will rate limit based on the caller's IP address (as
indicated by the `rateLimitBy` field). It will allow 2 requests
(`requestsAllowed`) every 1 minute (`timeWindowMinutes`). You can explore the
rest of the policy's documentation and configuration in the right panel.
To apply the policy, click **Create Policy**, then save your changes.
1. Testing your Policy
Now try firing some requests against your API. You should receive a **429 Too
many requests** on your 3rd request. You can use any API test tool you
prefer, such as Postman, HTTPie, or curl.
```bash
curl http://localhost:9000/todos
```
After you make the request 3 times you will see a response similar to:
```json
{
"type": "https://httpproblems.com/http-status/429",
"title": "Too Many Requests",
"status": 429,
"instance": "/todos",
"trace": {
"timestamp": "2025-08-26T21:50:40.220Z",
"requestId": "4c62d425-2cb0-4a6c-9ac0-8d04a5f10c57",
"buildId": "f49c4070-7c0a-441b-a5fd-4e35b5fe41b7"
}
}
```
Your rate limiting policy is now intercepting excess requests, protecting
your API.