Why would a website ban an IP over a typo or quick page request?

This sounds like an overconfigured intrusion-prevention or rate-limiting system. Tools such as fail2ban, mod_qos, and various web application firewalls can block an IP after several 404 responses, requests arriving too quickly, or other patterns that resemble automated scanning. Those rules can make sense when triggered after sustained suspicious activity, but banning someone over one typo or a single fast request is just a bad configuration.

If the site is running an old-looking custom stack, the problem may be less about a modern WAF and more about a simple server rule that reacts to certain status codes or request rates. A rule blocking every 404 or 418 in a short period would explain both the typo ban and the message about sending too many requests. It’s security theater when the threshold is so low that merely clicking around triggers it.

Rate limiting itself is normal, but it should normally return a temporary throttling response rather than permanently banning an entire workplace network. A single mistyped URL should never be treated like an exploit attempt unless it happens repeatedly alongside other scanning behavior. The administrator needs to review the logs, raise the thresholds, and add a reasonable temporary block and appeal process.

I’ve seen similar problems caused by administrators treating normal infrastructure as suspicious. One company was pressured to pay for a more expensive plan because its ISP address range looked like data-center space, even though there was no suspicious activity on the account. Another mail server rejected legitimate messages solely because they came through a major cloud provider. Security tools often make broad assumptions that punish ordinary users.