AnsweredAssumed Answered

Automated assessments via the website & throttling

Question asked by Michael Davey on Oct 13, 2015
Latest reply on Oct 13, 2015 by j-mailor



I have built an internal tool that sends automated requests to the SSL Labs website.


We submit up to 60 sites, at 1s intervals (ie submit a request for the first site, wait 1s, submit the next request and so on) and check on the progress of each one (reload the page) every 3s until complete.  We always use cached results if available.  We are hitting the SSL Labs servers harder during development and developer testing but generally we wouldn't expect the 60 sites to be checked more than a dozen times a day and typically around a dozen times a week.


We've recently discovered that Qualys have recently produced a web API that we could have used had we known.  We could still change to the web API I guess but it would be a reasonable amount of work and using the web page works well for us.


Occasionally we see the 'Too many new assessments too fast.  Please slow down' message.


My question is, what does SSL Labs consider reasonable?  Are our values of 1s and 3s reasonable or would you like either of these increased?  The one thing we don't do at the moment is limit the number of in-progress requests.  Would you like us to do that and if so what is reasonable for the number of in-progress requests?