diff --git a/package.json b/package.json
index 9e3e9a52d4..338485de34 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,8 @@
     "swagger-node-express": "git://github.com/lefnire/swagger-node-express#habitrpg",
     "passport": "~0.1.18",
     "passport-facebook": "~1.0.2",
-    "newrelic": "~1.3.0"
+    "newrelic": "~1.3.0",
+    "connect-ratelimit": "0.0.6"
   },
   "private": true,
   "subdomain": "habitrpg",
diff --git a/src/middleware.js b/src/middleware.js
index 829e9e2cc0..19ada70aaf 100644
--- a/src/middleware.js
+++ b/src/middleware.js
@@ -3,6 +3,24 @@ var _ = require('lodash');
 var fs = require('fs');
 var path = require('path');
 var User = require('./models/user').model
+var limiter = require('connect-ratelimit');
+
+module.exports.apiThrottle = function(app) {
+  app.use(limiter({
+    end:false,
+    catagories:{
+      normal: {
+        // 2 req/s, but split as minutes
+        totalRequests: 120,
+        every:         60000
+      }
+    }
+  })).use(function(req,res,next){
+    //console.log(res.ratelimit);
+    if (res.ratelimit.exceeded) return res.json(429,{err:'Rate limit exceeded'});
+    next();
+  });
+}
 
 module.exports.forceSSL = function(req, res, next){
   var baseUrl = nconf.get("BASE_URL");
diff --git a/src/server.js b/src/server.js
index 3d275a0abd..eaa527ad06 100644
--- a/src/server.js
+++ b/src/server.js
@@ -125,6 +125,7 @@ if (cluster.isMaster && (nconf.get('NODE_ENV') == 'development' || nconf.get('NO
   //}
 
   // Custom Directives
+  middleware.apiThrottle(app);
   app.use(require('./routes/pages').middleware);
   app.use(require('./routes/auth').middleware);
   var v2 = express();