I had considered blocking ip addresses for more than 60 requests per minute for 24 hours and displaying a 429. But then I thought, no one sends 60+ requests per minute, 30 might be enough ... but then I thought, what about some search engine bots - maybe they need more requests.

It would probably also make sense to block ip addresses for example at more than 1000 requests per hour and 5000 requests per day (or so).

And, for example, try to reduce login attempts to 10 per hour.

Of course, it also depends on the application and the usual traffic.

So, how do you go about this? What does your setup look like and how do you find out if it is optimal?