The form tries to send data through the WordPress REST API. The request reaches the endpoint /wp-json/contact-form-7/v1/contact-forms/.../feedback and receives a 429 status. The server tells the client that it has exceeded the allowed number of requests.
WordPress returns this response when a rate‑limit rule blocks further calls from the same IP address. The rule may live in the web server, a CDN, a security plugin, or the hosting environment. Each blocked call adds to the count, so a burst of submissions quickly triggers the limit.
When the limit is hit, the form never reaches the mail handler. No email is sent and the user sees a generic error message. The 429 response often includes a Retry-After header that tells the browser how long to wait before trying again.
Typical triggers include aggressive spam bots, mis‑configured caching of the REST endpoint, or a plugin that throttles API calls. Even a single broken script that repeatedly fires the AJAX call can fill the quota within seconds.
Understanding where the limit originates helps you adjust the rule without removing protection. Look at server logs, plugin settings, and CDN dashboards to locate the source.