<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Template Rate Limiting — API Reference

## Nuclei Rate Limiting CLI Flags

```bash
# Max requests per second
nuclei -rate-limit 10

# Max concurrent templates
nuclei -concurrency 5

# Bulk operations per second
nuclei -bulk-size 3

# Template threads (per-template parallelism)
nuclei -template-threads 5

# Combined stealth configuration
nuclei -rate-limit 5 -concurrency 2 -bulk-size 3
```

## Template-Level Threading

| Field | Type | Description |
|-------|------|-------------|
| `threads` | int | Per-template concurrent request threads |
| `stop-at-first-match` | bool | Stop payload iteration on first match |

## Rate Limit Response Headers

| Header | Description |
|--------|-------------|
| `X-RateLimit-Limit` | Maximum requests allowed per window |
| `X-RateLimit-Remaining` | Requests remaining in current window |
| `X-RateLimit-Reset` | UTC epoch when window resets |
| `Retry-After` | Seconds to wait before retrying |

## Rate Limit HTTP Status Codes

| Code | Meaning |
|------|---------|
| 429 | Too Many Requests |
| 503 | Service Unavailable (rate-related) |
| 403 | Forbidden (IP-based rate block) |

## Scan Timing Strategies

| Strategy | CLI Flags | Use Case |
|----------|-----------|----------|
| Stealth | `-rate-limit 2 -concurrency 1` | WAF-protected targets |
| Moderate | `-rate-limit 20 -concurrency 5` | Production API scanning |
| Fast | `-rate-limit 100 -concurrency 25` | Internal/lab targets |
| Unrestricted | (defaults) | Isolated test environments |
