WAF blocks: TooManyRequests (429) and country access (403)
The WAF (Web Application Firewall) is the protection layer in front of Demander systems. Two common blocks confuse support: 429 (too many requests from the same IP) and 403 by country (geographic origin). This article covers both.
Error 429 — WAF: TooManyRequests
Section titled “Error 429 — WAF: TooManyRequests”When opening the B2B Virtual Store or Demander Web, you may see a screen (often black) with JSON like this:
{ "erro": "WAF: TooManyRequests." }The HTTP status is usually 429. Access typically returns on its own after a few minutes. In many cases, another network or a VPN opens the page normally.
What does this error mean?
Section titled “What does this error mean?”The WAF limits how many requests the same public IP can make in a short period. When the limit is exceeded, it temporarily blocks that IP and returns WAF: TooManyRequests. This protects the environment against automated abuse, overload, and patterns that look like an attack.
Where does it appear?
Section titled “Where does it appear?”The error can occur in:
- B2B Virtual Store (domains such as
*.pedido.laand equivalent store hosts) - Demander Web panel (
https://sistema.demander.com.br)
In practice, the company’s same public IP hits the protection in front of these services. That is why, at peak times, several office users may lose access at once.
Why does it happen?
Section titled “Why does it happen?”Common situations:
| Situation | Why the limit is hit |
|---|---|
| Many users in the same office | They all exit through the same public IP |
| Peak hours | High volume of clicks, refreshes, and navigation |
| Refreshing the page repeatedly | Generates many requests in a few seconds |
| Integrations, bots, or scripts | May fire many calls that do not look like normal browsing |
| Another network / VPN | Changes the IP — which is why access “works” on VPN |
What to do when the 429 error appears
Section titled “What to do when the 429 error appears”For people using the store or the panel
Section titled “For people using the store or the panel”- Wait a few minutes and try again — the block is temporary.
- Avoid refreshing the page in a loop while the error is active.
- If you need to work right away, test on another network (mobile data) only to confirm the issue is the current network IP.
- Note the time, URL, and if possible a screenshot of the JSON screen.
For the admin / Demander support
Section titled “For the admin / Demander support”- Ask for the network’s public IP at the time of the error (for example meuip.com.br or whatismyipaddress.com).
- Also share the store hostname (e.g.
empresa.pedido.la) and whether the error happened only in the store, only in Demander Web, or both. - With that data, the technical team reviews WAF blocks and, when it makes sense (office with many users on the same IP), may add the IP to the allowlist.
Country access block (HTTP 403)
Section titled “Country access block (HTTP 403)”In some countries, access to https://sistema.demander.com.br is blocked by the WAF. This applies to the web panel and to mobile app sync, which uses the same address.
When the block happens, the response is HTTP 403 (forbidden). In the app, you usually see a WAF block message — it is not a password error or a “normal” sync failure.
Why does it exist?
Section titled “Why does it exist?”It is a security rule: if the connection comes from a country on the list below, access to sistema.demander.com.br is not allowed.
What to do?
Section titled “What to do?”- Confirm whether the person is in one of the listed countries (or using a network/VPN that appears to come from there).
- If it is a legitimate seller trip or expected customer access, open an internal ticket so the team can evaluate a one-off allow or a list change.
- Do not confuse this with 429 (too many requests) or a user locked by password attempts.
Blocked countries
Section titled “Blocked countries”Current list (49 countries, reference 11/09/2026). South Africa was removed on that date so international travel would not block seller sync.
| Code | Country |
|---|---|
| AE | United Arab Emirates |
| AF | Afghanistan |
| AL | Albania |
| AM | Armenia |
| BD | Bangladesh |
| BG | Bulgaria |
| CN | China |
| CZ | Czechia |
| DE | Germany |
| DK | Denmark |
| DO | Dominican Republic |
| EG | Egypt |
| ES | Spain |
| FR | France |
| GE | Georgia |
| GH | Ghana |
| HK | Hong Kong |
| HR | Croatia |
| HU | Hungary |
| ID | Indonesia |
| IL | Israel |
| IN | India |
| IQ | Iraq |
| IR | Iran |
| IT | Italy |
| JP | Japan |
| KE | Kenya |
| KP | North Korea |
| KR | South Korea |
| KZ | Kazakhstan |
| LB | Lebanon |
| LY | Libya |
| NG | Nigeria |
| NL | Netherlands |
| NP | Nepal |
| PH | Philippines |
| PL | Poland |
| PS | Palestine |
| RU | Russia |
| RW | Rwanda |
| SE | Sweden |
| SG | Singapore |
| SK | Slovakia |
| SY | Syria |
| TH | Thailand |
| TR | Turkey |
| TW | Taiwan |
| UA | Ukraine |
| VN | Vietnam |
Quick summary
Section titled “Quick summary”| Question | 429 (TooManyRequests) | 403 (country) |
|---|---|---|
| What is it? | Temporary block for too many requests from the same IP | Block of sistema.demander.com.br by country of origin |
| HTTP status | 429 | 403 |
| Clears alone? | Yes, usually after a few minutes | No — while the origin stays on the list |
| Affects the app? | Indirectly (same IP / panel) | Yes — sync uses the same host |
| Password / locked user? | No | No |
| Support next step | Public IP + time; review allowlist | Confirm country/VPN; review one-off allow |