User Limits

Overview

User Limits protect your OpenAI budget from abuse. Every chat message costs you money on your own OpenAI account, so WPiko Chatbot limits how many messages each visitor (counted by IP address) and your whole site can send. Visitors can still chat as guests. Limits only stop unusually heavy use.

Since WPiko Chatbot 2.1.1, limits are on by default for every site, and a set of safety limits always applies, even if you switch your own limits off. You’ll find the settings in WPiko Chatbot → Manage & Tools → User Limits.

The Limits at a Glance

Your own hourly and daily limits can only make things stricter. A value above the safety limit (for example 500 per hour) has no effect, because the safety limit of 60 per hour still applies.

How It Works

• Counted per IP address. Each visitor is identified by their IP address. Logged-in users are counted the same way as guests.
• Counted before the AI replies. A message uses up one place in every limit as soon as it’s sent, before OpenAI is called. Messages that fail afterwards (for example an OpenAI error) still count, so failures can’t be used to get around the limits.
• Fixed time windows. Each window starts with the first message counted in it and resets when that hour, day or minute is over. It isn’t a rolling window.
• Every limit must have room. If any limit is full (per-minute, hourly, daily or site-wide), the message is blocked.
• The site-wide limit counts messages, not money. 1,000 messages a day can cost very different amounts depending on your model and reasoning effort. Also set a monthly budget in your OpenAI account.
• Safe under heavy load. Counters are stored in their own database table and updated in a single step, so many messages sent at the same moment can’t slip past a limit. They don’t depend on transients or your object cache.
• Fails safe. If the visitor’s IP address can’t be read, or the counters can’t be stored, the message is blocked instead of being sent to OpenAI without a limit.

Live Takeover (Pro)

While an admin is handling a conversation with WPiko Chatbot Pro’s Admin Takeover, your own hourly and daily limits are skipped for that conversation, so live support isn’t interrupted. The safety limits and the site-wide daily limit still count those messages.

Configuring User Limits

1. Go to WPiko Chatbot → Manage & Tools → User Limits.
2. Leave Enable Custom User Limits on to use your own hourly and daily limits.
3. Set the Hourly Limit and Daily Limit per IP.
4. Set the Site-wide Daily Limit for all visitors together.
5. Optionally write your own Limit Reached Message.
6. Click Save User Limits.

Settings

Choosing a site-wide limit: start from how many chat messages your site gets on a busy day and add some room. If genuine visitors start seeing the limit message late in the day, raise it. If your OpenAI bill is higher than you’d like, lower it.

Message and Reply Size Limits

To stop a single message from becoming expensive, two size limits always apply:

• Visitor messages: up to 16,000 bytes, about 16,000 characters of English text. Languages with accented or non-Latin letters use more bytes per character, so the limit is lower in characters (roughly 8,000 for Greek or Russian). Longer messages are rejected with “Your message is too long. Please shorten it and try again.” They don’t count toward any limit.
• AI replies: up to 8,192 tokens per request to OpenAI, including the model’s reasoning. That’s far more than a normal chat answer needs.

What Happens When a Visitor Is Blocked

• The visitor sees your Limit Reached Message (or the default) in the chat window. Nothing is sent to OpenAI.
• Blocked messages are not saved to Conversations, so a flood of requests can’t fill your database. (Before 2.1.1 they were saved as error rows.)
• For developers: non-streaming requests get an HTTP 429 JSON error, and streaming requests get an error event. Both have type: rate_limit.

Upgrading from an Earlier Version

When you update to 2.1.1, your saved choices are kept and the new protection is added automatically:

• If you never saved User Limits, the new defaults apply: 20 per hour and 100 per day per IP.
• If you had turned User Limits off, they stay off, but the safety limits and the 1,000-per-day site-wide limit now apply.
• If you had set a limit to 0, the safety limit for that window applies instead.
• Counts start fresh after the update.

Troubleshooting

Many Visitors Are Blocked at Once

Your site is probably behind a proxy or CDN (such as Cloudflare), so every visitor appears to have the proxy’s IP address and they all share one set of limits. Use the wpiko_chatbot_client_ip filter to read the real visitor IP. See Developer Hooks and Filters. If visitors are blocked late in the day, the site-wide daily limit may be full: raise it in User Limits.

Every Message Is Blocked, Even the First

• The visitor’s IP address may not be readable, or a custom wpiko_chatbot_client_ip filter returns something that isn’t a valid IP. Check the filter.
• The limits table may be missing, for example if the database user can’t create tables. The table is created automatically and is named {prefix}wpiko_chatbot_rate_limits. Ask your host to check that it exists.

My Higher Limit Isn’t Working

Per-IP limits can’t go above the safety limits (60 per hour, 300 per day, 10 per minute). Setting 500 per hour still allows only 60. Only the site-wide daily limit can be raised.

I Blocked Myself While Testing

Admins are counted too. Wait for the window to reset (one minute for the burst limit, otherwise up to an hour or a day), or test from another network.

Best Practices

• Keep the defaults to start with, then adjust once you see how much your visitors chat.
• Set the site-wide daily limit to match your budget, and also set a monthly budget limit in your OpenAI account.
• Write a friendly Limit Reached Message that offers another way to reach you, such as your email or contact page.
• Behind a CDN or reverse proxy, set up the wpiko_chatbot_client_ip filter so limits apply to real visitors, not the proxy.