The key parameter of rate limiting is burst tolerance (burst); setting it too strict will mistakenly penalize normal users' concurrent loading, while setting it too loose will not stop crawlers; in practice it usually requires combining log analysis, first observing the normal traffic baseline before setting the threshold, and pairing it with 429 status codes and Retry-After response headers to guide compliant crawlers to slow down.