diff --git a/services/web/app/src/router.js b/services/web/app/src/router.js
index 8d1e4cb63d..c589b3bfb9 100644
--- a/services/web/app/src/router.js
+++ b/services/web/app/src/router.js
@@ -262,6 +262,11 @@ function initialize(webRouter, privateApiRouter, publicApiRouter) {
   webRouter.get(
     '/project',
     AuthenticationController.requireLogin(),
+    RateLimiterMiddleware.rateLimit({
+      endpointName: 'open-project',
+      maxRequests: 20,
+      timeInterval: 60
+    }),
     ProjectController.projectListPage
   )
   webRouter.post(