MangaDex Development Update - API Abuse Enforcement

[Grogzilla]

Howdy! As mentioned in our March 2026 and April 2026 development updates, our enforcement of API Abuse has gone live this morning.

What Is This For?
Earlier this year we experienced massive amounts of abuse from scrapers that degraded our service and caused lengthy downtimes. This is our effort to reduce that and prevent degraded service for all users.

What Does This Do?
We have limited our advanced search and the amount of chapters guests can read to 10 chapters per day. By doing this, we are able to prevent bots, scraping, and as a result, ensure a smoother reading experience for users with an account.

What Do I Need To Do?

• If you already have an account, login and continue to use the site as normal, you already have access to the best reading experience currently available. We are working tirelessly to make improvements and make MangaDex even better.
• If you don't have an account, make one! All that's required is a username, password, and an email. This will give you full access to our features such as the updates tab, your library, MDLists, advanced search, and completely removes the 10 chapters per day restriction.

Thank you for reading on MangaDex!

 

[panzerkampfwagyu]

Hmmm... I do wonder if rate limiting wouldn't be enough to fix the scraper issue instead without hindering the general user experience?
Taking away advanced search seems alright, but 10 chaps a day does seem like it makes the site not really usable for a visitor who might then go to AIDS-giving sites like Kissmanga instead

 

[Angry_Panda]

@Grogzilla - thanks for the clarification.

One question related to the update, but not the API portion - the User search function has been removed from the left hand menu on the mainsite (it was in with the Forum link and the Group search/add), and that page ( mangadex.org/users ) has been removed/deactivated, but the search bar at top of the mainsite still brings up usernames in the results, and attempts to link to the now-removed page if you click on the results subheader there. Is this a permanent change, with a fix coming to remove the broken link in the search bar, or will the user search be restored at some point?

 

[shinya78]

Hmmm... I do wonder if rate limiting wouldn't be enough to fix the scraper issue instead without hindering the general user experience?

We already have rate limiting, approximately 5 requests per second per IP, apparently it's not enough.

 

[panzerkampfwagyu]

We already have rate limiting, approximately 5 requests per second per IP, apparently it's not enough.

That's certainly weird.
I do wonder what would be the difference between limiting API access and access to those site features.
Like, if they can trick the rate limit already, what makes this one different?

 

[Grogzilla]

One question related to the update, but not the API portion - the User search function has been removed from the left hand menu on the mainsite (it was in with the Forum link and the Group search/add), and that page ( mangadex.org/users ) has been removed/deactivated, but the search bar at top of the mainsite still brings up usernames in the results, and attempts to link to the now-removed page if you click on the results subheader there. Is this a permanent change, with a fix coming to remove the broken link in the search bar, or will the user search be restored at some point?

Not sure, first I'm hearing of it. I will ask around and see what I can find out

 

[CharaDotArchivist]

We already have rate limiting, approximately 5 requests per second per IP, apparently it's not enough.

that's the thing, these types of bad actors tend to use a lot of IPs in order to get around rate limiting to bog down the servers over a longer period of time
by adding a hard limit, i'm assuming MD is trying to mitigate high, consistent server load

 

[saitohd]

Coming up next year:

• Users without an account can't access the chapters.
• Users with a free account can read up to 10 chapters per day.
• Paid membership users can read everything for the low price of $9,99 per month.

I'm only joking of course. Or am I?

 

[shinya78]

that's the thing, these types of bad actors tend to use a lot of IPs in order to get around rate limiting to bog down the servers over a longer period of time
by adding a hard limit, i'm assuming MD is trying to mitigate high, consistent server load

So... what's stopping them from using even more IPs when hitting the hard limit? What would happen to the guest users that are using shared IPs when they try to read but suddenly get hit with the chapter limit cap when they haven't even started yet? Mitigated by logging-in/making an account, though to me this part feels more of a push towards the social-style commenting that will be implemented later.

Coming up next year:

• Users without an account can't access the chapters.
• Users with a free account can read up to 10 chapters per day.
• Paid membership users can read everything for the low price of $9,99 per month.

I'm only joking of course. Or am I?

I mean... it happened somewhere before.
Stares at two very specific websites

 

[Mangamoz]

Hopefully this will help get rid of those mysterious anon guests that creepily stalk the top traffic forums 24/7.

I swear some of them are comment tracking bots from publishing companies scanning for keywords.

(This is just me guessing on a hunch, this is not proven)

 

[mikhi]

Playing devils advocate here, but if you'd really want to stop API Abuse, why hasn't the actual API been limited yet?

 

[boursk]

(This is just me guessing on a hunch, this is not proven)

Now that you've said it out loud, it has manifested into reality!

 

[panzerkampfwagyu]

that's the thing, these types of bad actors tend to use a lot of IPs in order to get around rate limiting to bog down the servers over a longer period of time
by adding a hard limit, i'm assuming MD is trying to mitigate high, consistent server load

The question is how the new method avoids the IP switching, like, what stops them from doing it again?
Like, not allowing advanced search I can see, but the 10-chapter limit/day doesn't really make sense, given that it is more annoying to humans than to bots.

 

[b-no]

FYI, just reiterating what I said in the April 2026 dev post:

Okay. I just tested the scenarios that you mentioned. From what I checked, the feature has two trackers--one for the guest and another for the logged in account.

For first scenario, reading a chapter while logged in doesn't count towards the guest limit. The chapters read when logged in is tracked by the account tracker.

For the second scenario, logging in doesn't reset the guest tracker. It retains the number of chapters read when you were on guest mode. Furthermore, logging out doesn't clear the guest tracker too so you'll see the limit pop up if you already read at least 10 chapters on guest mode. I think the only way to reset is after midnight (though not sure if it's server or user's time).

Also, bear in mind that refreshing page while reading a chapter also counts towards the guest limit so I guess mobile guest users are fucked since smartphones tend to refresh pages if left for some time.

Honestly, this feature seems to be a half-baked one--a temporary solution to a more robust protection. I would be surprised if this is a permanent solution. This might slow down scrapers but it doesn't stop scraping because it is really easy to bypass with a few lines of code given that the feature is implemented on the frontend.

 

[shinya78]

The question is how the new method avoids the IP switching, like, what stops them from doing it again?
Like, not allowing advanced search I can see, but the 10-chapter limit/day doesn't really make sense, given that it is more annoying to humans than to bots.

Not to mention, they could probably just add a log-in feature in their app, make an account to log into, bypass the 10-chapter limit that way, then continue scraping away.

 

[panzerkampfwagyu]

Not to mention, they could probably just add a log-in feature in their app, make an account to log into, bypass the 10-chapter limit that way, then continue scraping away.

That one would be really easy to detect though, given that one account would do data requests not possible by a human.

 

[shinya78]

That one would be really easy to detect though, given that one account would do data requests not possible by a human.

I suppose drastically slowing the requests per second and adding a randomizer to determine when to make the requests to make it look human would just... drastically slow it down (shocking, I know), it still bypasses the hard 10 chapter limit though, and they're still scraping away. Now imagine if they decide to use more than just one account...

 

[panzerkampfwagyu]

I suppose drastically slowing the requests per second and adding a randomizer to determine when to make the requests to make it look human would just... drastically slow it down (shocking, I know), it still bypasses the hard 10 chapter limit though, and they're still scraping away. Now imagine if they decide to use more than just one account...

It would slow down the scraping to a degree that they might as well use the API and adhere to the rate limiting at that point though.

 

[mikhi]

Honestly, this feature seems to be a half-baked one--a temporary solution to a more robust protection. I would be surprised if this is a permanent solution. This might slow down scrapers but it doesn't stop scraping because it is really easy to bypass with a few lines of code given that the feature is implemented on the frontend.

Why would scrapers even need the frontend? As I said the API has no limits. You can just carefully code your scarper to not trigger rate limits there. Maybe rotate around the IP. It really isn't hard to make a functional scraper that doesn't have to touch the Fronted.

 

[shinya78]

It would slow down the scraping to a degree that they might as well use the API and adhere to the rate limiting at that point though.

I wouldn't count on it, if my experience in classic RO tells me something, it's not the time to get to level 99/farm tons of rare item drops that makes one resort to botting, it's the manual effort needed to get there. Botters gotta bot, scrapers gotta scrape. If they resort to flooding the database with accounts just to bypass the 10-chapter limit, well...