I noticed that I can only perform certain actions such as commenting a finite number of times in a given period of time. Obviously, rate limiting is in place to prevent accidental misuse or intentional abuse of certain features.
Where else is rate limiting applied on Stack Exchange sites, and what are the limits?
Applies to the entire network; if one makes too many requests on one or more sites, access to all network sites is restricted
Does not apply to non-load-balanced services not served from the same network as public Q&A (chat, the API, etc.)
Should not be triggered during normal browsing; if you get it, it either means you're sharing your IP with multiple users accessing the network, or your browser or an extension is hitting the site with one or more extra requests every time you load a page
Voting & Flagging
Same amount of comment flags as one does post flags (default 10, may rise up to 100 based on flagging activity or reputation; see Flagging below)
Comment flag and post flag allowances are separate
Other per-site limits may apply; e.g. on Stack Overflow, new users can only ask once every 90 minutes. Some of these per-site limits do also check the account, not just the IP address.
While the limit is waived for users with 125+ reputation on a given site, questions posted on sites where one has 125+ reputation still count toward the rate limit for sites where one doesn't. For instance, if you ask a question on a site where you have 150 rep, you can't ask another question on a site where you have only 100 rep for the next 40 minutes; however, you can ask them in reverse order immediately (first on the 100-rep site, then on the 150-rep site).
Limit is partially waived if submitting a tag wiki and excerpt suggested edit at the same time (which counts as two edits) - if the user only has space for one more pending edit, both edits will still be allowed, but they cannot submit another suggested edit until two of their pending edits are approved (i.e. they're no longer exceeding the limit)
Unregistered users can't suggest edits on posts < 10 minutes old
Users with < 10k rep trip CAPTCHA* if more than once per 30 seconds, or faster than 5 seconds after starting edit
Users with ≥ 10k rep trip CAPTCHA* if more than once per 10 seconds, or faster than 5 seconds after starting edit
You can only save a tag wiki edit once every 30 seconds, or once every 10 seconds if you have enough reputation (20k/4k on beta sites) to bypass the review queue. (Submitting a tag wiki edit along with a tag wiki excerpt edit at the same time for the same tag is not limited.)
* For all of the above thresholds for hitting CAPTCHA, if you have at least 200 reputation and have solved a CAPTCHA in the last 5 minutes, you will not have to solve one again.
30 votes per day +10 for questions only (question-only votes can't be used once you've cast 25 votes on answers) (source)
To further elaborate: you get 10 Q-votes and 30 QA-votes per day. When you vote on a question, you'll use a Q-vote, and on an answer, you'll use a QA-vote. If you run out of Q-votes, you can continue voting on questions, but you'll be using QA-votes. However, once you have only 5 QA-votes left, you'll be blocked from using your Q-votes and all of your remaining voting for the day will use your QA-votes.
If one of the posts you vote on gets deleted the same day as you vote, your limit is recalculated as if you never cast that vote (i.e. in most cases, you can cast one more vote, but if you now have more than 5 unused QA-votes, your Q-votes will be unblocked, allowing you to vote more times).
If you vote and undo your vote 30 times, your vote gets locked in.
3 failed attempts within a minute before a CAPTCHA is displayed
Last username change must be less than 15 minutes or more than 30 days ago. Does not apply to ♦ mods or accounts that are less than 2 days old.
Other than that, the counts between self-deleted posts and delete votes for others' posts are kept separate: the number of self-deleted posts is limited to 5 per the above criteria, and if you've used all your delete votes but have not hit the above limit, you can still delete your own posts up until the limit (the counter will show as negative).
Question must be closed in order to be able to vote to delete it
Note that this is likely to change given that app-specific API features are gradually being retired due to the discontinuation of the apps.
Stack Exchange API
API request quotas
Request quotas are the maximum number of API requests in a rolling 24-hour period.
Maximum of 300 queries per 24 hours per IP address, if not using an API key value. Requests with an API key also count against this quota. It is not separate from the 10k quota, which means these 300 requests are likely to be consumed by applications using an API key.
Maximum of 10,000 queries per day per API key and IP address pair, if using a per-application API key, with some exceptions:
Some high-profile tools that actively help out with the Stack Exchange network receive special keys that grant them an extended limit (e.g., SmokeDetector has a limit of 80,000)
The above noted exemption for the iOS app, which has a special key that doesn't have daily API limits (see above section for more details)
The quota which is applied to the IP address is the same for all API requests made with a key value in the 24-hour period. The quota value which is used is the maximum quota assigned to any key which is used to make a request from that IP address within that 24 hour period (e.g., if a key with a 50k quota is used for a single request on the IP address, then all requests with a valid key value from that IP address in that 24 hour period have a 50k quota, regardless of what their normal quota would be).
Requests which use an access_token, in addition to a key, use a quota which is tied to the access_token. An access_token uniquely identifies an application + user pair. Each user has up to 5 additional 10,000 request quota pools which are allocated separately to the first 5 application + user pairs used for that user in a 24-hour period. Requests made with an access_token do not count against the IP based quotas.
Occasionally, queries can return a backoff value, to indicate how much time a given application needs to wait before it can perform another query. This value depends on the number and speed of the queries and the overall load on SE's servers, and can change based on various other factors. The exact criteria used for issuing a backoff are not disclosed.
SE uses multiple layers of rate limiting for the SE API. The criteria used for the rate limiting layers are not disclosed. Rate limiting is implemented both by the above mentioned backoff response and requests returning various errors, potentially with no additional information.