Limits and defaults

This page lists the HostRepute limits and defaults that don’t depend on the plan, one table per area. How to change says where you change a value; Fixed means HostRepute sets it and you can’t change it.

• Limits that depend on the plan, such as how many domains and IPs a team can monitor, are in plans and limits.
• When the portal and the API accept different values, the tables give the stricter one the server enforces.
• A request over a rate limit is refused with 429. API responses carry a Retry-After header with the seconds to wait; Rate limits shows how to back off.

Rate limits

Setting	Default	How to change
API requests	120 requests per minute per team	Fixed
Test alerts (portal and API)	5 per minute per team	Fixed
MCP server requests	60 requests per minute per user	Fixed
Certificate agent requests, per IP address	60 requests per minute per IP address	Fixed
Certificate agent requests, per agent token	60 requests per minute per agent token	Fixed
AI assistant requests (chat, summaries and playbooks)	20 requests per minute per team	Fixed
Manual scans	10 per minute per user	Fixed
Adding, editing or removing Domains & IPs and check profiles	60 changes per minute per user	Fixed
Running a certificate, domain expiry or uptime check on demand	6 per minute per user	Fixed
Sending a test scheduled report	6 per minute per user	Fixed
Syncing an integration on demand (Microsoft SNDS, Gmail Postmaster Tools, ESP)	6 per minute per user	Fixed
Member invitations	10 invitations per minute per member, in each team	Fixed
Failed sign-in attempts	5 failed attempts per email address and IP address in a 60-second window	Fixed
Two-factor codes at sign-in	6 attempts per minute per account and per IP address, and 10 per 30 minutes per account	Fixed
Starting single sign-on	10 per minute per email address, and 60 per minute per IP address	Fixed
Password reset emails	One every 60 seconds per account	Fixed
Shared report links, reputation badges and public status pages	120 requests per minute per IP address	Fixed
Reputation check on the HostRepute website (/check)	3 scans per IP address per day	Fixed

Domains & IPs

Setting	Default	How to change
Name	255 characters	Fixed
Domain or IP address	255 characters	Fixed
Tag length	50 characters per tag	Fixed

Check profiles

Setting	Default	How to change
Name	255 characters	Fixed
Description	1,000 characters	Fixed
What a profile checks	At least one blocklist, or email authentication checks turned on	Fixed

Email authentication

Setting	Default	How to change
Domain or IP address to check	255 characters	Fixed

Certificates

Setting	Default	How to change
Monitor name	255 characters	Fixed
Host	255 characters	Fixed
Port	1 to 65535	Fixed
SNI hostname	255 characters	Fixed
Monitors per bulk action	50 monitors	Fixed
Certificate profile name	80 characters	Fixed
Check interval	Up to 720 hours (30 days)	Set per certificate profile; the shortest interval depends on your plan
Warning thresholds	1 to 10 thresholds	Set per certificate profile
Warning threshold	0 to 90 days before expiry	Set per certificate profile
Default warning thresholds	60, 30, 14, 7 and 1 days before expiry	Set per certificate profile
Alert events	At least one event turned on	Set per certificate profile
Certificate agent name	80 characters	Fixed

Uptime

Setting	Default	How to change
Monitor name	120 characters	Fixed
URL (HTTP(S) monitors)	2,048 characters	Fixed
Host (TCP port monitors)	255 characters	Fixed
Port	1 to 65535	Fixed
Expected status code	100 to 599	Set per monitor
Keyword	255 characters	Fixed
Give up after (seconds)	1 to 15 seconds	Set per monitor
Slow after (milliseconds)	100 to 60,000 milliseconds, and lower than the timeout	Set per monitor
Alert after this many failed checks in a row	1 to 5 checks	Set per monitor

Domain expiry

Setting	Default	How to change
Monitor name	255 characters	Fixed
Domain	255 characters	Fixed
Default warning thresholds	30, 14 and 7 days before expiry	Fixed
Automatic check interval	Every 24 hours	Fixed

Alert channels

Setting	Default	How to change
Email address	255 characters	Fixed
Slack webhook URL	2,048 characters, HTTPS	Fixed
Telegram chat ID	255 characters	Fixed
Discord webhook URL	2,048 characters, HTTPS	Fixed
PagerDuty routing key	255 characters	Fixed
Pushover user key	255 characters	Fixed
Webhook endpoint URL	2,048 characters, HTTPS	Fixed
Webhook signing secret	32 to 255 characters	Fixed

Delivery hours

Setting	Default	How to change
Name	255 characters	Fixed
Daily window	One window per weekday, start and end as HH:MM (24-hour), end after start	Set per weekday

Scheduled reports

Setting	Default	How to change
Name	120 characters	Fixed
Host tag	50 characters	Fixed
Recipients	1 to 20 email addresses, each used once	Set per report
Recipient email address	255 characters	Fixed
Send day (monthly reports)	Day 1 to 31 of the month	Set per report
Test sends	6 a minute per member	Fixed

Status pages

Setting	Default	How to change
Name	120 characters	Fixed
Summary	500 characters	Fixed
Domains and IPs on a page	1 to 50, each listed once	Fixed
Subscribe requests on a public status page	6 a minute per IP address	Fixed

Delisting requests

Setting	Default	How to change
Note	5,000 characters	Fixed
Evidence file	10 MB; PDF, PNG, JPG, TXT, EML, MSG or CSV	Fixed

Campaign preflight

Setting	Default	How to change
Email to check (pasted, or an uploaded .eml file)	2,048 KB (2 MB)	Fixed
Links checked per email	The first 100 links	Fixed
Redirects followed per link	5 redirects	Fixed

Integrations

Setting	Default	How to change
Microsoft SNDS integration name	255 characters	Fixed
SNDS Automated Data Access URLs	2,048 characters each	Fixed
Gmail Postmaster Tools domain	253 characters	Fixed
Gmail Postmaster Tools domain user email	254 characters	Fixed
ESP integration name	255 characters	Fixed
ESP API key	512 characters	Fixed
ESP server prefix	32 characters	Fixed
Yahoo Sender Hub notes	2,000 characters	Fixed

Team

Setting	Default	How to change
Team name	2 to 50 characters	Fixed
Team avatar	An image up to 1 MB (1,024 KB)	Fixed
Blocklist check interval, shortest	Every 30 minutes	Set in team settings; plans without faster checks start at every hour
Blocklist check interval, longest	Every 48 hours	Set in team settings
Callback signing secret	64 characters, generated by HostRepute	Not shown or rotatable in the portal yet

Members

Setting	Default	How to change
Invitation email address	255 characters	Fixed

Profile

Setting	Default	How to change
Name	255 characters	Fixed
Email address	255 characters	Fixed
Avatar file	JPEG or PNG, up to 1 MB (1,024 KB)	Fixed
Avatar dimensions	Up to 2,048 × 2,048 pixels	Fixed
Password	At least 8 characters	Fixed
Passkey name	255 characters	Fixed
MCP token name	80 characters	Fixed

API tokens

Setting	Default	How to change
Token name	80 characters	Fixed
Abilities	At least one	Set per token
Expiry date	Optional; must be in the future	Set per token

API lists

Setting	Default	How to change
Items per page in API lists	15 items	The per_page query parameter
Largest per_page	100 items	Fixed

Single sign-on

Setting	Default	How to change
Email domain	237 characters	Fixed
OIDC issuer URL	2,048 characters, HTTPS	Fixed
OIDC client ID	255 characters	Fixed
OIDC client secret	2,048 characters	Fixed
SAML IdP entity ID	2,048 characters	Fixed
SAML IdP SSO URL	2,048 characters, HTTPS	Fixed
SAML IdP certificate	10,000 characters	Fixed

Credit auto-recharge

Setting	Default	How to change
Low-balance threshold, as a percentage	5% to 50%	Set in billing
Low-balance threshold, as a number of credits	At least 1 credit	Set in billing
Recharges per month	1 to 20	Set in billing
Low-balance threshold, default	20% of the credits bought	Set in billing
Package in the payment link, default	Standard	Set in billing
Recharges per month, default	5	Set in billing
Another payment link while the balance stays low	At most one every 6 hours	Fixed
Low-credit warning email	When a use leaves 10 credits or fewer, at most once every 24 hours	Fixed

Referrals

Setting	Default	How to change
Credits for the team that shared the link	500 credits per referral that qualifies	Fixed
Credits for the referred team	500 credits when its referral qualifies	Fixed
Referrals that earn credits	20 per team that shares the link	Fixed
Referral link remembered in the visitor's browser	30 days from the first visit with the link	Fixed

Data retention

Setting	Default	How to change
Microsoft SNDS data and resolved SNDS IP statuses	90 days	Fixed
Gmail Postmaster Tools daily data	90 days	Fixed
Shared report links and scheduled report links	90 days after they are created	Fixed
Email submitted to a campaign preflight	24 hours	Fixed

Timers and expiry

Setting	Default	How to change
Team invitation	Expires after 7 days	Fixed
Password reset link	Expires after 60 minutes	Fixed
Resending the email verification message	Once every 60 seconds	Fixed
Two-factor step at sign-in	10 minutes (600 seconds) after the password step	Fixed
Confirming two-factor setup	10 minutes (600 seconds)	Fixed
Password confirmation before sensitive settings	Lasts 3 hours	Fixed
Domains and IPs added by a manual scan and not monitored	Removed 30 days after they are added	Fixed
SNDS Automated Data Access links	Treated as expiring 30 days after you save them	Fixed
SNDS link expiry warning	5 days before the links expire	Fixed
Certificate agent marked offline	After 15 minutes without contact	Fixed
Delisting request follow-up date	7 days after the request is marked submitted or waiting, when no date is set	Change the follow-up date on the delisting request
Status page subscription confirmation link	Expires after 7 days	Fixed
Trial	14 days	Fixed
Trial ending reminder email	Sent 3 days before the trial ends	Fixed
Email change confirmation link	Expires after 60 minutes	Fixed

Scans

Setting	Default	How to change
How often HostRepute looks for domains and IPs that are due a scheduled scan	Every 30 minutes	Fixed. How often each domain or IP is scanned is set in team settings, within the plan's limits
First scan of a domain or IP you add	Starts right away when it's monitored and within the plan's limit, without using credits	Fixed
A blocklist's answer for the same domain or IP	Reused for up to 1 hour, by every scan	Fixed
A scan that is still checking	Marked as failed after 15 minutes	Fixed
How often HostRepute sends blocklist alerts for the changes scheduled scans found	Every 5 minutes	Fixed. Delivery hours can hold an alert until they open

Free tools on hostrepute.com

Setting	Default	How to change
Lookups with one free tool	10 per minute per IP address, for each tool	Fixed
Security checks (Cloudflare Turnstile) across all free tools and SuperTool	20 per minute per IP address	Fixed
New SuperTool scans	3 per IP address per day	Fixed
SuperTool result for a domain or IP scanned recently	Shown again for 10 minutes, without counting as a new scan	Fixed
Shared link to a reputation check result (/check)	Expires after 7 days	Fixed
Shared link to a SuperTool result	Expires after 7 days	Fixed

API checks

Setting	Default	How to change
Callback URL (callback_url) of a blocklist or certificate check	2,048 characters, HTTPS, public addresses only	Fixed
A blocklist check started through the API that hasn't ended	Marked failed and refunded 15 minutes after it started, without a callback	Fixed
A certificate check that can't get a certificate from the host	Tried 3 times, 30 and then 60 seconds apart, then marked failed and refunded	Fixed

Webhooks

Setting	Default	How to change
Webhook alert channel, time your endpoint has to answer	10 seconds, 5 of them to connect	Fixed
Webhook alert channel, attempts per alert	3, 250 and 750 milliseconds apart, after a 4xx or 5xx status, a timeout or a connection error	Fixed
Scan callback, time your endpoint has to answer	30 seconds, 10 of them to connect	Fixed
Scan callback, attempts per check	3, the second 30 seconds and the third 60 seconds after the one before, after a 429 or 5xx status, a timeout or a connection error	Fixed

Related

• Plans and limits lists the limits of each plan.
• Credit costs lists what uses credits.
• MCP tools, resources and prompts covers the MCP server the rate limits mention.
• Statuses and what they mean explains the statuses these timers change.