Skip to content

Complete outage of explorer.lichess.ovh – all requests return 429 Too Many Requests #19610

Description

@Chronogram

Exact URL of where the bug happened

https://explorer.lichess.ovh/masters?fen=rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR%20w%20KQkq%20-%200%201

https://explorer.lichess.ovh/lichess?fen=rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR%20w%20KQkq%20-%200%201&variant=standard&speeds=blitz,rapid,classical&ratings=2200,2500

Description
Since approximately February 23, 2026 (coinciding with the major OVH infrastructure incident that affected Lichess), the opening explorer service at explorer.lichess.ovh has been completely unresponsive. Every request to both the /lichess and /masters endpoints returns an HTTP 429 error, regardless of parameters, headers, or the requesting IP.

Steps to reproduce the bug

  1. Standard request with all required parameters (as per API docs)

    curl -v "https://explorer.lichess.ovh/lichess?fen=rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR%20w%20KQkq%20-%200%201&variant=standard&speeds=blitz,rapid,classical&ratings=2200,2500"
  2. Masters endpoint

    curl -v "https://explorer.lichess.ovh/masters?fen=rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR%20w%20KQkq%20-%200%201"
  3. With explicit Accept: application/json header

    curl -v -H "Accept: application/json" "https://explorer.lichess.ovh/lichess?fen=rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR%20w%20KQkq%20-%200%201&variant=standard&speeds=blitz,rapid,classical&ratings=2200,2500"
  4. Different speed/rating combinations

    curl -v "https://explorer.lichess.ovh/lichess?fen=rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR%20w%20KQkq%20-%200%201&variant=standard&speeds=bullet,blitz&ratings=2000,2200"
  5. Different FEN (after 1.e4)

    curl -v "https://explorer.lichess.ovh/lichess?fen=rnbqkbnr/pppppppp/8/8/4P3/8/PPPP1PPP/RNBQKBNR%20b%20KQkq%20-%200%201&variant=standard&speeds=blitz,rapid,classical&ratings=2200,2500"
  6. Full browser emulation (all headers)

    curl -v -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8" -H "Accept-Language: en-US,en;q=0.5" -H "Accept-Encoding: gzip, deflate, br" -H "Connection: keep-alive" "https://explorer.lichess.ovh/lichess?fen=rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR%20w%20KQkq%20-%200%201&variant=standard&speeds=blitz,rapid,classical&ratings=2200,2500"

What did you expect to happen?

Each request should return a JSON object with opening statistics (for /lichess) or master game data (for /masters).

What happened instead?

❯ curl -v "https://explorer.lichess.ovh/lichess?fen=rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR%20w%20KQkq%20-%200%201&variant=standard&speeds=blitz,rapid,classical&ratings=2200,2500"
* Host explorer.lichess.ovh:443 was resolved.
* IPv6: (none)
* IPv4: 162.19.30.63
*   Trying 162.19.30.63:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=explorer.lichess.ovh
*   start date: Dec 27 13:37:13 2025 GMT
*   expire date: Mar 27 13:37:12 2026 GMT
*   issuer: C=US; O=Let's Encrypt; CN=E8
*   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
*   subjectAltName: "explorer.lichess.ovh" matches cert's "explorer.lichess.ovh"
* SSL certificate verified via OpenSSL.
* Established connection to explorer.lichess.ovh (162.19.30.63 port 443) from 192.168.0.30 port 59580 
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://explorer.lichess.ovh/lichess?fen=rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR%20w%20KQkq%20-%200%201&variant=standard&speeds=blitz,rapid,classical&ratings=2200,2500
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: explorer.lichess.ovh]
* [HTTP/2] [1] [:path: /lichess?fen=rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR%20w%20KQkq%20-%200%201&variant=standard&speeds=blitz,rapid,classical&ratings=2200,2500]
* [HTTP/2] [1] [user-agent: curl/8.18.0]
* [HTTP/2] [1] [accept: */*]
> GET /lichess?fen=rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR%20w%20KQkq%20-%200%201&variant=standard&speeds=blitz,rapid,classical&ratings=2200,2500 HTTP/2
> Host: explorer.lichess.ovh
> User-Agent: curl/8.18.0
> Accept: */*
> 
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 429 
< server: nginx
< date: Wed, 25 Feb 2026 01:27:06 GMT
< content-type: text/html; charset=utf-8
< content-length: 162
< access-control-allow-origin: *
< access-control-allow-methods: GET,OPTIONS
< access-control-allow-headers: Accept,If-Modified-Since,Cache-Control,X-Requested-With
< 
<html>
<head><title>429 Too Many Requests</title></head>
<body>
<center><h1>429 Too Many Requests</h1></center>
<hr><center>nginx</center>
</body>
</html>
* Connection #0 to host explorer.lichess.ovh:443 left intact


Operating system

CachyOS x86_64

Browser and version (or alternate access method)

Firefox 147.0.4 (64-bit), curl 8.18.0

Additional information

Observations

  • The error occurs identically for both /lichess and /masters endpoints.
  • It persists across different parameter combinations (speeds, ratings, variant).
  • It is not affected by headers – browser‑like User-Agent and Accept headers do not change the outcome.
  • It is not FEN‑specific – the same error occurs for the starting position and after 1.e4.
  • It is not IP‑specific – previously tested from multiple ISPs (home, mobile data) with the same result.
  • The service was working normally before the OVH outage on Feb 23, 2026.
  • Third‑party confirmation – The application En Croissant also fails to connect to the explorer, showing a SyntaxError when attempting to load data (see attached screenshot). This indicates the outage is not limited to our testing environment.

Environment

  • API host: explorer.lichess.ovh (IPv4: 162.19.30.63)
  • Tested from: Linux, curl 8.18.0
  • All requests use HTTPS (TLS 1.3)

Image

openingtree.com says: "Failed to fetch book moves" and "Please check your internet connection. Lichess could also be down."

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions