The original title is: "Every response promised a rate limit. Nothing enforced it."

Short summary

A documentation site was advertising RateLimit headers on every response without any actual rate-limiting logic behind them—a classic agent-readiness defect where a declared surface has no code resolving it. The fix uses Cloudflare Workers rate limiting bindings keyed on client IP, failing open if the binding breaks. A key lesson: a burst probe returning 130 requests with zero 429s proved nothing, because the threshold was never reached—the code reading was the only reliable signal.

• •Site declared RateLimit headers but had zero enforcement logic—no 429s, no counter, no limiter
• •Fixed with Cloudflare Workers rate limiting binding, keyed on client IP, failing open by design
• •A burst probe of 130 requests returned identical results on broken and fixed sites—code reading caught what testing missed

Generated with AI, which can make mistakes.