Fix 429 Webhook Response

I run a PHP-based webhook on a Hostage VPS KVM8. During traffic spikes the endpoint suddenly answers with HTTP 429 instead of the expected 200, so the calling service retries and eventually fails. The code itself has no limiter, which makes me suspect a server-level restriction that I’m not yet aware of.

Your task is to trace the component issuing the 429s and tune or disable the rule so the webhook survives peak loads. It could be an Nginx/Apache rate-limit, ModSecurity, fail2ban, iptables, or something similar—I’m open to whatever you find.

Acceptance criteria
• Pinpoint the exact service or module returning 429
• Apply and document a configuration fix (or clean, minimal code patch if that proves necessary)
• Stress-test the endpoint and demonstrate consistent 200 responses under load
• Provide a short hand-off note describing what was changed and any future monitoring you recommend

Root SSH access is ready once we agree on a window; let me know which logs or metrics you want ahead of time so I can queue them up.