QR Scan Quotas: You Never See the Failure, Your Customers Do

That is what makes metering the least understood of the dynamic-QR failure modes. Unlike an expired subscription, it does not break the code cleanly — it breaks it for some people, sometimes, and never while you are testing.

Why does a scan limit exist at all?

Not because scanning is expensive. Serving an HTTP redirect is among the cheapest operations on the internet — a database lookup and a 301, measured in fractions of a cent per million.

A quota exists because it is a billing lever tied to your success. Scans correlate with how well your campaign is going, so metering scans prices the provider into your outcomes. It is the same instinct as per-code pricing, applied to volume instead of quantity — and both are only possible because the redirect put them in the path. The real cost of a "free" QR code covers the wider pricing landscape.

What does a scanner actually see past the cap?

Ranked by how hard they are to detect, the bottom two rows are the dangerous ones: a code that works intermittently passes every test you run and fails only under load, which is precisely when it matters.

Why is the timing so bad?

Because quotas reset monthly while attention does not arrive evenly. Campaigns spike — an event weekend, a press mention, a busy Saturday service, a product going viral. The spike is the point of the campaign.

A monthly cap converts that spike into a cliff. You hit the quota on day nine of a thirty-day cycle, and the remaining three weeks either cost overage or fail. Worse, the failure lands on the marginal visitor: the person who scanned because a friend recommended it, at the moment your material was working best. You paid to print it, you earned the attention, and the code stopped at the peak.

How do you tell a quota from an ordinary outage?

Four checks, in order:

1. Decode the printed code. If the payload is your own domain, this is not a quota — it is your own infrastructure. Go to why your QR code stopped working. Use our decoder.
2. Request the short link directly, in a private window, and see what comes back. An upgrade page or ad page is conclusive.
3. Follow the redirect chain. curl -sIL "https://short.example/abc" shows each hop — see how to check where a QR code really leads.
4. Compare the timing against your billing cycle. Failure that begins mid-month and clears on the reset date is a quota, not an outage.

Test from a phone on mobile data, not office Wi-Fi. Some rate limiting is per-IP, and the office address may already be classified differently from a customer's.

How do you estimate the scan volume you will actually need?

Most people size a plan against their average and get caught by their peak. Size against the peak instead, because the peak is the only number a quota interacts with.

A rough method: take your busiest realistic day for the placement — a full Saturday service, the opening day of an event, the week a product launches — multiply by the number of codes on that plan, and multiply by four for a month that contains several such days. Then double it, because the campaigns worth printing are the ones that outperform. If the resulting figure is anywhere near the quota, the quota will bind at the worst possible moment.

This is also worth doing before you sign, not after, and it is where per-code pricing compounds with metering: a shared quota across fourteen table tents is exhausted fourteen times faster than the pricing page implies. The real cost of a "free" QR code covers how these two levers interact.

The honest conclusion of the exercise is usually that the numbers do not justify the mechanism. Serving a redirect costs the provider a negligible amount per million requests; the quota is not tracking their costs, it is tracking your success.

How does throttling interact with phishing risk?

Indirectly, and it is worth knowing about. When a code returns an unexpected interstitial or error page, people do not conclude that the business has a billing problem. They conclude the code is broken and look for another way in — and a scanner who has learned that unfamiliar pages are a normal part of scanning is a scanner who has lost the ability to recognise a malicious one.

Unit 42 makes the underlying point about shortened links generally: "Even security-conscious people who check the URL preview before scanning cannot determine the final destination". Every interstitial a provider serves on your printed material trains your customers further in that direction. Quishing covers the consequence.

What can you do about it?

In the short term, the only lever is the one the provider designed: upgrade, or accept the failures. If codes are live and failing on customers, buy one month on the cheapest tier that restores service and use the window to exit — the sequence is in the hostage recovery guide.

The permanent fix is to remove the meter from the path. A static QR code encodes your destination directly, so a scan is a request to your own server. There is no counter, no cap, and no third party deciding whether to forward. Your hosting already handles far more traffic than any QR campaign will produce, and if it does not, that is a capacity question you can solve on your own terms.

If you need editability as well, run the redirect yourself: point static codes at yourcompany.com/m and change what that path serves. Unlimited by construction, because you own both ends. See own your QR codes forever.

Remove the meter: URL QR code, static, unlimited by construction. Background: the truth about QR code scams.