A website without AI costs almost nothing, however many people visit it. With AI that changes: every question, every section written on and every assessment creates costs at the language model. A single script asking questions in a loop can use more in one night than all real visitors in a month. This is how we protect our website against that - without slowing down real visitors.
In short
- Session token instead of an IP block: whoever uses the AI features gets a short-lived token on the first call. The limits are tied to the session, not to the IP address.
- Open limits: 10 questions per minute to the assistant, 60 light calls per minute for suggestions. Anyone who reaches the limit sees how long to wait.
- A separate budget per feature: chat, checking, articles and references have separate budgets. If one is used up, only that feature stops.
- A fixed cap: the server function never runs more than a fixed number of calls at the same time. Overload creates waiting time, not a bill.
Every question costs money
On classic websites visitors are almost free: pages come from the cache, and more visitors mean hardly any more costs. On a website with AI, every answer has a price at the model provider - depending on the length of question and answer.
In normal operation that is easy to plan. It gets dangerous with abuse: bots that fill in forms automatically, scripts that call interfaces directly, or AI agents that query a website in loops. Without protection, the operator pays for every one of these requests.
A token instead of an IP block
The obvious protection would be a limit per IP address. But that hits the wrong people: in many companies all employees go online through the same address, and on mobile networks many strangers often share one address. A limit per IP would slow down whole companies at once - and teams from large enterprises are our most important visitors.
That is why every browser gets a short-lived, signed token on its first AI call. It is valid for 30 minutes and the browser renews it in time, even shortly after it expires. The limits count per session: two colleagues behind the same company address have separate allowances.
The IP address only still plays a role when new tokens are issued - generously, so that a whole office can start at the same time. Anyone who already has a session is never affected. After 12 hours at most, a new session begins.
Clear limits - and what happens when you reach them
We distinguish two kinds of calls:
- Heavy - the assistant, the growing article and the assessment of a page: 10 per minute and session. Hardly anyone asks faster.
- Light - suggestions for further reading and short sentences about them: 60 per minute. They come up on their own while browsing.
The magazine editions of our articles and references have no limit: each edition is created once and then delivered from storage.
Every response states the remaining allowance in standard headers. When questions run low, the assistant shows “2 questions left this minute”. When the limit is reached, it says in how many seconds you can continue - instead of an unexplained error.
A separate budget per feature
Every AI feature of the website uses its own access to the model gateway with its own budget: the assistant, the check of every answer, the growing home page, continuing articles and references, the suggestions. So we see exactly what each feature costs.
Above all, each feature can be stopped on its own. If the budget of one feature is used up, only that feature stops - the rest of the website and the other AI features keep running. A fallback access only steps in when an access is technically invalid, never when a budget is reached.
On top of that there is a cap on the server side: the function that handles all AI calls never runs more than a fixed number of calls at the same time. Even a flood of requests cannot drive costs up without limit.
Bots get a neutral message
Anyone who behaves like a bot - for example by calling without a valid token or by filling in fields people cannot even see - gets a neutral maintenance message. They do not learn how we recognised them and cannot adjust their behaviour on purpose.
Real visitors practically never see this message. When a token expires, the browser quietly gets a new one.
What this means for your project
The same questions come up with every AI feature that is public or reachable by many users - in a customer portal, a dealer network or an app:
- Who may do how much? Limits per session or user instead of per IP address, communicated openly.
- What does each feature cost? Separate accesses and budgets, so costs can be attributed and capped one by one.
- What happens under overload? A fixed cap, so load turns into waiting time and not into a bill.
We plan this from the start - as part of the architecture, not as an afterthought after the first unexpected invoice. How we handle data is described in Where this website runs.
