Rate limits
Two kinds of budget slow a caller down before anything bans it: the management API's, which count failures, and each instance's own, which count requests.
The console and the management API
The Rate limiting card on the Configuration tab of Security > Firewall sets the management API's failure budgets per group, with a flood multiplier for traffic that arrives far faster than a person could produce it. It is a budget on failures rather than a cap on traffic: a caller getting things wrong repeatedly is what it is looking for. Its Sign-in group is what protects the console's own sign-in, beside the account lockout and Cloudflare Turnstile.
Each instance's own site is rate-limited too
Separately from the management API, every instance's site carries its own budgets, enforced by the web server in front of the instance. They are on by default with rates a real deployment does not meet, and editable per instance in the Rate limiting card on the Configuration tab of that instance's Firewall.
| Budget | Default | What it protects |
|---|---|---|
| Sign-in | 12 requests per minute, burst 6 | The door a guessing run knocks on |
| General | 15 requests per second, burst 40 | The dynamic locations |
| Picture burst | 400, at the general rate | Pictures and files (/web/image, /web/content) |
Pictures and files share the general rate with a much larger burst, because an Odoo list or kanban view loads one picture per record at once: eighty contacts are eighty avatars in well under a second. Every other path keeps the general burst a scanner trips on. An existing instance gets the picture burst the next time its configuration is applied.
Assets, the websocket and long-polling are deliberately exempt. One page load fetches dozens of assets, and throttling the socket breaks the client rather than the abuser.
A refused caller gets 429 with a Retry-After, and the refusal lands in the instance's access
log - which is what makes it bannable.
Rate limiting answers 429 forever; it never bans. The ohm-429 jail on Security > Threat
protection turns repeated 429s into a ban. A new server ships it enabled, with the ohm-4xx
jail and ohm-login; a server installed earlier keeps what its settings say. See
Intrusion prevention.