Per visitor network, for each site: your site's rate setting (1 to 600 per minute, 60 by default) caps how often one visitor network can request challenges and tokens. A visitor network is an IPv4 address or an IPv6 /64.
Proof-of-work difficulty: 8 to 16 bits per site (12 by default). Each extra bit doubles the average work. A visitor network asking one site for more than 10 challenges a minute gets up to 6 extra bits before the rate limit answers 429 (an IPv6 /64 also counts toward its /48, which shares 16 times one network's rate), and a site under a sudden surge adds up to 4 bits for everyone, for as long as the surge lasts. Older version 1 scripts solve at most 20 bits: a busy network that would need more is answered 429 until it slows down. See how long the work takes.
Platform limits protect the shared service from floods on the browser and verification endpoints. They answer 429 rate_limited and are set well above normal traffic; contact us before a launch or a load test.
