diff --git a/docs/content/docs/concepts/rate-limit.mdx b/docs/content/docs/concepts/rate-limit.mdx
index 63b0cd70be..984741a135 100644
--- a/docs/content/docs/concepts/rate-limit.mdx
+++ b/docs/content/docs/concepts/rate-limit.mdx
@@ -6,7 +6,7 @@ description: Learn how to configure rate limiting in Better Auth, including IP a
 
 Better Auth includes a built-in rate limiter to help manage traffic and prevent abuse. By default, in production mode, the rate limiter is set to:
 
-* Window: 60 seconds
+* Window: 10 seconds
 * Max Requests: 100 requests
 
 <Callout type="warning">
@@ -45,7 +45,7 @@ In addition to the default settings, Better Auth provides custom rules for speci
 
 In addition, plugins also define custom rules for specific paths. For example, `twoFactor` plugin has custom rules:
 
-* `/two-factor/verify`: Is limited to 3 requests within 10 seconds.
+* `/two-factor/*`: Is limited to 3 requests within 10 seconds.
 
 These custom rules ensure that sensitive operations are protected with stricter limits.