diff --git a/front/gemini/gemini.go b/front/gemini/gemini.go
index 7dc35015..1b2be5da 100644
--- a/front/gemini/gemini.go
+++ b/front/gemini/gemini.go
@@ -67,7 +67,7 @@ func getUser(ctx context.Context, db *sql.DB, conn net.Conn, tlsConn *tls.Conn,
 	return &actor, nil
 }
 
-func handle(ctx context.Context, handler front.Handler, conn net.Conn, db *sql.DB, resolver *fed.Resolver, wg *sync.WaitGroup, log *slog.Logger) {
+func Handle(ctx context.Context, handler front.Handler, conn net.Conn, db *sql.DB, resolver *fed.Resolver, wg *sync.WaitGroup, log *slog.Logger) {
 	if err := conn.SetDeadline(time.Now().Add(reqTimeout)); err != nil {
 		log.Warn("Failed to set deadline", "error", err)
 		return
@@ -187,7 +187,7 @@ func ListenAndServe(ctx context.Context, log *slog.Logger, db *sql.DB, handler f
 
 			wg.Add(1)
 			go func() {
-				handle(requestCtx, handler, conn, db, resolver, &wg, log)
+				Handle(requestCtx, handler, conn, db, resolver, &wg, log)
 				conn.Close()
 				timer.Stop()
 				cancelRequest()
diff --git a/front/register.go b/front/register.go
index 31317121..40284268 100644
--- a/front/register.go
+++ b/front/register.go
@@ -19,14 +19,18 @@ package front
 import (
 	"crypto/sha256"
 	"crypto/tls"
+	"database/sql"
 	"fmt"
 	"github.com/dimkr/tootik/cfg"
 	"github.com/dimkr/tootik/front/text"
 	"github.com/dimkr/tootik/front/user"
 	"net/url"
 	"regexp"
+	"time"
 )
 
+const registrationInterval = time.Hour
+
 var userNameRegex = regexp.MustCompile(`^[a-zA-Z0-9-_]{4,32}$`)
 
 func register(w text.Writer, r *request) {
@@ -103,6 +107,22 @@ func register(w text.Writer, r *request) {
 		return
 	}
 
+	var lastRegister sql.NullInt64
+	if err := r.QueryRow(`select max(inserted) from persons where host = ?`, cfg.Domain).Scan(&lastRegister); err != nil {
+		r.Log.Warn("Failed to check last registration time", "name", userName, "error", err)
+		w.Error()
+		return
+	}
+
+	if lastRegister.Valid {
+		now := time.Now()
+		elapsed := now.Sub(time.Unix(lastRegister.Int64, 0))
+		if elapsed < registrationInterval {
+			w.Statusf(40, "Registration is closed for %s", (registrationInterval - elapsed).Truncate(time.Second).String())
+			return
+		}
+	}
+
 	r.Log.Info("Creating new user", "name", userName)
 
 	if _, err := user.Create(r.Context, r.DB, fmt.Sprintf("https://%s/user/%s", cfg.Domain, userName), userName, certHash); err != nil {
diff --git a/front/stats.go b/front/stats.go
index 4be4266f..7e774290 100644
--- a/front/stats.go
+++ b/front/stats.go
@@ -74,7 +74,7 @@ func getUsersGraph(r *request) string {
 func getInstancesGraph(r *request) string {
 	keys := make([]string, 7)
 	values := make([]int64, 7)
-	return getGraph(r, `select strftime('%Y-%m-%d', datetime(days.day, 'unixepoch')), count(*) from (select substr(substr(persons.id, 9), 1, instr(substr(persons.id, 9), '/')-1) as host, min(inserted/(60*60*24)*60*60*24) as day from persons group by host) hosts join (select distinct inserted/(60*60*24)*60*60*24 as day from persons where inserted>unixepoch()-60*60*24*7 and inserted<unixepoch()/(60*60*24)*60*60*24) days on hosts.day < days.day group by days.day`, keys, values)
+	return getGraph(r, `select strftime('%Y-%m-%d', datetime(days.day, 'unixepoch')), count(*) from (select host, min(inserted/(60*60*24)*60*60*24) as day from persons group by host) hosts join (select distinct inserted/(60*60*24)*60*60*24 as day from persons where inserted>unixepoch()-60*60*24*7 and inserted<unixepoch()/(60*60*24)*60*60*24) days on hosts.day < days.day group by days.day`, keys, values)
 }
 
 func getActiveUsersGraph(r *request) string {
diff --git a/migrations/009_host.go b/migrations/009_host.go
new file mode 100644
index 00000000..fea88941
--- /dev/null
+++ b/migrations/009_host.go
@@ -0,0 +1,18 @@
+package migrations
+
+import (
+	"context"
+	"database/sql"
+)
+
+func host(ctx context.Context, tx *sql.Tx) error {
+	if _, err := tx.ExecContext(ctx, `ALTER TABLE persons ADD COLUMN host TEXT AS (substr(substr(id, 9), 0, instr(substr(id, 9), '/')))`); err != nil {
+		return err
+	}
+
+	if _, err := tx.ExecContext(ctx, `CREATE INDEX personshost on persons(host)`); err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/test/register_test.go b/test/register_test.go
new file mode 100644
index 00000000..909a799e
--- /dev/null
+++ b/test/register_test.go
@@ -0,0 +1,748 @@
+/*
+Copyright 2023 Dima Krasner
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package test
+
+import (
+	"context"
+	"crypto/tls"
+	"database/sql"
+	"fmt"
+	"github.com/dimkr/tootik/fed"
+	"github.com/dimkr/tootik/front"
+	"github.com/dimkr/tootik/front/gemini"
+	"github.com/dimkr/tootik/front/user"
+	"github.com/dimkr/tootik/migrations"
+	"github.com/stretchr/testify/assert"
+	"io"
+	"log/slog"
+	"net"
+	"os"
+	"sync"
+	"testing"
+)
+
+var (
+	/*
+	   openssl ecparam -name prime256v1 -genkey -out /tmp/ec.pem
+	   openssl req -new -x509 -key /tmp/ec.pem -sha256 -nodes -subj "/CN=localhost.localdomain" -out cert.pem -keyout key.pem -days 3650
+	*/
+	serverCert = `-----BEGIN CERTIFICATE-----
+MIIBlTCCATugAwIBAgIUOGTIsA9mqhGNYtYpbQOGyQT0nFMwCgYIKoZIzj0EAwIw
+IDEeMBwGA1UEAwwVbG9jYWxob3N0LmxvY2FsZG9tYWluMB4XDTIzMTEwMTA2NTMz
+MFoXDTMzMTAyOTA2NTMzMFowIDEeMBwGA1UEAwwVbG9jYWxob3N0LmxvY2FsZG9t
+YWluMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEVNlOzZ9KfKeYYiqZNXnoV/fQ
+9k+DfRqxWInuK5y7ELr3Pr2eYvfu7Xaf8QGjbGQxL3u2JzdtaNCfPzN41Ek2ZKNT
+MFEwHQYDVR0OBBYEFPTIrvyjUvvDj9My+0UJegEpWrWoMB8GA1UdIwQYMBaAFPTI
+rvyjUvvDj9My+0UJegEpWrWoMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SAAwRQIhAJYpAxqES3+AEJicrYv+vpyvfEd9eMBHrubIE1TUAtKqAiBz1kzKzmiQ
+MrE9j+LF/+UCOfJBrRiimWzvo6f3wpFdMQ==
+-----END CERTIFICATE-----`
+
+	serverKey = `-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgLY7FG8+1FoNtWhqM
+yxCtWh+7hNUTnM3I8YVOLo8KkyuhRANCAARU2U7Nn0p8p5hiKpk1eehX99D2T4N9
+GrFYie4rnLsQuvc+vZ5i9+7tdp/xAaNsZDEve7YnN21o0J8/M3jUSTZk
+-----END PRIVATE KEY-----`
+
+	/*
+	   openssl ecparam -name prime256v1 -genkey -out /tmp/ec.pem
+	   openssl req -new -x509 -key /tmp/ec.pem -sha256 -nodes -subj "/CN=erin" -out cert.pem -keyout key.pem -days 3650
+	*/
+	erinCert = `-----BEGIN CERTIFICATE-----
+MIIBczCCARmgAwIBAgIUb+Vb5itzgaYGeKectZ/R0vTl4dIwCgYIKoZIzj0EAwIw
+DzENMAsGA1UEAwwEZXJpbjAeFw0yMzExMDEwNzMzNDRaFw0zMzEwMjkwNzMzNDRa
+MA8xDTALBgNVBAMMBGVyaW4wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARlOXQM
+XCHmESk7Zzor+JhUFjIwf/vM/KbIgszEUXJ7ccMctWelADHc5dJjrf/nbXhvf/NA
+y0ibEVc6KM97dRMPo1MwUTAdBgNVHQ4EFgQUG0V5VrS+Wj3U3A4j2tgdJKTYmn8w
+HwYDVR0jBBgwFoAUG0V5VrS+Wj3U3A4j2tgdJKTYmn8wDwYDVR0TAQH/BAUwAwEB
+/zAKBggqhkjOPQQDAgNIADBFAiEA84fpaDdh6JRaT4R7qGdhfO9zYnJ6VcQEnAiN
+eXPo8z4CIBkYBJV6O6+Pvmjxs6SAa6c8SVb4Q72lJQpe0woYdmXf
+-----END CERTIFICATE-----`
+
+	erinKey = `-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgwpYr2U3MW256QQjk
+7hUgeic6Imr/bzK7gcwLkQ6Sc4uhRANCAARlOXQMXCHmESk7Zzor+JhUFjIwf/vM
+/KbIgszEUXJ7ccMctWelADHc5dJjrf/nbXhvf/NAy0ibEVc6KM97dRMP
+-----END PRIVATE KEY-----`
+
+	/*
+	   openssl ecparam -name prime256v1 -genkey -out /tmp/ec.pem
+	   openssl req -new -x509 -key /tmp/ec.pem -sha256 -nodes -subj "/CN=david" -out cert.pem -keyout key.pem -days 3650
+	*/
+	davidCert = `-----BEGIN CERTIFICATE-----
+MIIBdDCCARugAwIBAgIUEN8F95Gx0Aea4jbONtJtrFVYjBowCgYIKoZIzj0EAwIw
+EDEOMAwGA1UEAwwFZGF2aWQwHhcNMjMxMTAxMDgxMTEzWhcNMzMxMDI5MDgxMTEz
+WjAQMQ4wDAYDVQQDDAVkYXZpZDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABId5
+Vy+MFm/KjtCgRGoW0lYcT4q3EAnUvfj3Qg0LnQN42YaAlrhKvUMHZ52BpYQK0DFI
+X7laKw6O/cUANgm2Kw2jUzBRMB0GA1UdDgQWBBSFlyVsYu+R1RcUHCH8TV2fUAlX
+zTAfBgNVHSMEGDAWgBSFlyVsYu+R1RcUHCH8TV2fUAlXzTAPBgNVHRMBAf8EBTAD
+AQH/MAoGCCqGSM49BAMCA0cAMEQCIHkaUT5KHy+kkvMryZGUnkX1oqB/e/lvFFg7
+uSGGclcgAiA1eqHRDwFml4oSVDi3sMF9OtVXqp/ktJLsarP/IZ81jA==
+-----END CERTIFICATE-----`
+
+	davidKey = `-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgA9Tox1/NjVs3av3C
+f7Kgs5SdkJkcanCS3Ibes8Tsm+ChRANCAASHeVcvjBZvyo7QoERqFtJWHE+KtxAJ
+1L3490INC50DeNmGgJa4Sr1DB2edgaWECtAxSF+5WisOjv3FADYJtisN
+-----END PRIVATE KEY-----`
+)
+
+type dialResult struct {
+	Conn net.Conn
+	Err  error
+}
+
+func TestRegister_Redirect(t *testing.T) {
+	assert := assert.New(t)
+
+	dbPath := fmt.Sprintf("/tmp/%s.sqlite3?_journal_mode=WAL", t.Name())
+	db, err := sql.Open("sqlite3", dbPath)
+	assert.NoError(err)
+	defer os.Remove(dbPath)
+
+	assert.NoError(migrations.Run(context.Background(), slog.Default(), db))
+
+	serverKeyPair, err := tls.X509KeyPair([]byte(serverCert), []byte(serverKey))
+	assert.NoError(err)
+
+	serverCfg := tls.Config{
+		Certificates: []tls.Certificate{serverKeyPair},
+		MinVersion:   tls.VersionTLS12,
+		ClientAuth:   tls.RequestClientCert,
+	}
+
+	erinKeyPair, err := tls.X509KeyPair([]byte(erinCert), []byte(erinKey))
+	assert.NoError(err)
+
+	clientCfg := tls.Config{
+		Certificates:       []tls.Certificate{erinKeyPair},
+		InsecureSkipVerify: true,
+	}
+
+	socketPath := fmt.Sprintf("/tmp/%s.socket", t.Name())
+
+	localListener, err := net.Listen("unix", socketPath)
+	assert.NoError(err)
+	defer os.Remove(socketPath)
+
+	tlsListener := tls.NewListener(localListener, &serverCfg)
+	defer tlsListener.Close()
+
+	unixReader, err := net.Dial("unix", socketPath)
+	assert.NoError(err)
+	defer unixReader.Close()
+
+	tlsWriter, err := tlsListener.Accept()
+	assert.NoError(err)
+
+	tlsReader := tls.Client(unixReader, &clientCfg)
+	defer tlsReader.Close()
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		assert.NoError(tlsReader.Handshake())
+		wg.Done()
+	}()
+	go func() {
+		assert.NoError(tlsWriter.(*tls.Conn).Handshake())
+		wg.Done()
+	}()
+	wg.Wait()
+
+	_, err = tlsReader.Write([]byte("https://localhost.localdomain/users\r\n"))
+	assert.NoError(err)
+
+	gemini.Handle(context.Background(), front.NewHandler(), tlsWriter, db, fed.NewResolver(nil), &wg, slog.Default())
+
+	tlsWriter.Close()
+
+	resp, err := io.ReadAll(tlsReader)
+	assert.NoError(err)
+
+	assert.Equal("30 /users/register\r\n", string(resp))
+}
+
+func TestRegister_HappyFlow(t *testing.T) {
+	assert := assert.New(t)
+
+	dbPath := fmt.Sprintf("/tmp/%s.sqlite3?_journal_mode=WAL", t.Name())
+	db, err := sql.Open("sqlite3", dbPath)
+	assert.NoError(err)
+	defer os.Remove(dbPath)
+
+	assert.NoError(migrations.Run(context.Background(), slog.Default(), db))
+
+	serverKeyPair, err := tls.X509KeyPair([]byte(serverCert), []byte(serverKey))
+	assert.NoError(err)
+
+	serverCfg := tls.Config{
+		Certificates: []tls.Certificate{serverKeyPair},
+		MinVersion:   tls.VersionTLS12,
+		ClientAuth:   tls.RequestClientCert,
+	}
+
+	erinKeyPair, err := tls.X509KeyPair([]byte(erinCert), []byte(erinKey))
+	assert.NoError(err)
+
+	clientCfg := tls.Config{
+		Certificates:       []tls.Certificate{erinKeyPair},
+		InsecureSkipVerify: true,
+	}
+
+	socketPath := fmt.Sprintf("/tmp/%s.socket", t.Name())
+
+	localListener, err := net.Listen("unix", socketPath)
+	assert.NoError(err)
+	defer os.Remove(socketPath)
+
+	tlsListener := tls.NewListener(localListener, &serverCfg)
+	defer tlsListener.Close()
+
+	unixReader, err := net.Dial("unix", socketPath)
+	assert.NoError(err)
+	defer unixReader.Close()
+
+	tlsWriter, err := tlsListener.Accept()
+	assert.NoError(err)
+
+	tlsReader := tls.Client(unixReader, &clientCfg)
+	defer tlsReader.Close()
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		assert.NoError(tlsReader.Handshake())
+		wg.Done()
+	}()
+	go func() {
+		assert.NoError(tlsWriter.(*tls.Conn).Handshake())
+		wg.Done()
+	}()
+	wg.Wait()
+
+	_, err = tlsReader.Write([]byte("https://localhost.localdomain/users/register\r\n"))
+	assert.NoError(err)
+
+	gemini.Handle(context.Background(), front.NewHandler(), tlsWriter, db, fed.NewResolver(nil), &wg, slog.Default())
+
+	tlsWriter.Close()
+
+	resp, err := io.ReadAll(tlsReader)
+	assert.NoError(err)
+
+	assert.Equal("30 /users\r\n", string(resp))
+}
+
+func TestRegister_AlreadyRegistered(t *testing.T) {
+	assert := assert.New(t)
+
+	dbPath := fmt.Sprintf("/tmp/%s.sqlite3?_journal_mode=WAL", t.Name())
+	db, err := sql.Open("sqlite3", dbPath)
+	assert.NoError(err)
+	defer os.Remove(dbPath)
+
+	assert.NoError(migrations.Run(context.Background(), slog.Default(), db))
+
+	serverKeyPair, err := tls.X509KeyPair([]byte(serverCert), []byte(serverKey))
+	assert.NoError(err)
+
+	serverCfg := tls.Config{
+		Certificates: []tls.Certificate{serverKeyPair},
+		MinVersion:   tls.VersionTLS12,
+		ClientAuth:   tls.RequestClientCert,
+	}
+
+	erinKeyPair, err := tls.X509KeyPair([]byte(erinCert), []byte(erinKey))
+	assert.NoError(err)
+
+	clientCfg := tls.Config{
+		Certificates:       []tls.Certificate{erinKeyPair},
+		InsecureSkipVerify: true,
+	}
+
+	socketPath := fmt.Sprintf("/tmp/%s.socket", t.Name())
+
+	localListener, err := net.Listen("unix", socketPath)
+	assert.NoError(err)
+	defer os.Remove(socketPath)
+
+	tlsListener := tls.NewListener(localListener, &serverCfg)
+	defer tlsListener.Close()
+
+	unixReader, err := net.Dial("unix", socketPath)
+	assert.NoError(err)
+	defer unixReader.Close()
+
+	tlsWriter, err := tlsListener.Accept()
+	assert.NoError(err)
+
+	tlsReader := tls.Client(unixReader, &clientCfg)
+	defer tlsReader.Close()
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		assert.NoError(tlsReader.Handshake())
+		wg.Done()
+	}()
+	go func() {
+		assert.NoError(tlsWriter.(*tls.Conn).Handshake())
+		wg.Done()
+	}()
+	wg.Wait()
+
+	_, err = tlsReader.Write([]byte("https://localhost.localdomain/users/register\r\n"))
+	assert.NoError(err)
+
+	_, err = user.Create(context.Background(), db, "https://localhost.localdomain/user/erin", "erin", "e")
+	assert.NoError(err)
+
+	gemini.Handle(context.Background(), front.NewHandler(), tlsWriter, db, fed.NewResolver(nil), &wg, slog.Default())
+
+	tlsWriter.Close()
+
+	resp, err := io.ReadAll(tlsReader)
+	assert.NoError(err)
+
+	assert.Equal("10 erin is already taken, enter user name\r\n", string(resp))
+}
+
+func TestRegister_Twice(t *testing.T) {
+	assert := assert.New(t)
+
+	dbPath := fmt.Sprintf("/tmp/%s.sqlite3?_journal_mode=WAL", t.Name())
+	db, err := sql.Open("sqlite3", dbPath)
+	assert.NoError(err)
+	defer os.Remove(dbPath)
+
+	assert.NoError(migrations.Run(context.Background(), slog.Default(), db))
+
+	serverKeyPair, err := tls.X509KeyPair([]byte(serverCert), []byte(serverKey))
+	assert.NoError(err)
+
+	serverCfg := tls.Config{
+		Certificates: []tls.Certificate{serverKeyPair},
+		MinVersion:   tls.VersionTLS12,
+		ClientAuth:   tls.RequestClientCert,
+	}
+
+	erinKeyPair, err := tls.X509KeyPair([]byte(erinCert), []byte(erinKey))
+	assert.NoError(err)
+
+	clientCfg := tls.Config{
+		Certificates:       []tls.Certificate{erinKeyPair},
+		InsecureSkipVerify: true,
+	}
+
+	socketPath := fmt.Sprintf("/tmp/%s.socket", t.Name())
+
+	localListener, err := net.Listen("unix", socketPath)
+	assert.NoError(err)
+	defer os.Remove(socketPath)
+
+	tlsListener := tls.NewListener(localListener, &serverCfg)
+	defer tlsListener.Close()
+
+	for _, expected := range []string{
+		"30 /users\r\n",
+		"40 Already registered as erin\r\n",
+	} {
+
+		unixReader, err := net.Dial("unix", socketPath)
+		assert.NoError(err)
+		defer unixReader.Close()
+
+		tlsWriter, err := tlsListener.Accept()
+		assert.NoError(err)
+
+		tlsReader := tls.Client(unixReader, &clientCfg)
+		defer tlsReader.Close()
+
+		var wg sync.WaitGroup
+		wg.Add(2)
+		go func() {
+			assert.NoError(tlsReader.Handshake())
+			wg.Done()
+		}()
+		go func() {
+			assert.NoError(tlsWriter.(*tls.Conn).Handshake())
+			wg.Done()
+		}()
+		wg.Wait()
+
+		_, err = tlsReader.Write([]byte("https://localhost.localdomain/users/register\r\n"))
+		assert.NoError(err)
+
+		gemini.Handle(context.Background(), front.NewHandler(), tlsWriter, db, fed.NewResolver(nil), &wg, slog.Default())
+
+		tlsWriter.Close()
+
+		resp, err := io.ReadAll(tlsReader)
+		assert.NoError(err)
+
+		assert.Equal(expected, string(resp))
+	}
+}
+
+func TestRegister_Throttling(t *testing.T) {
+	assert := assert.New(t)
+
+	dbPath := fmt.Sprintf("/tmp/%s.sqlite3?_journal_mode=WAL", t.Name())
+	db, err := sql.Open("sqlite3", dbPath)
+	assert.NoError(err)
+	defer os.Remove(dbPath)
+
+	assert.NoError(migrations.Run(context.Background(), slog.Default(), db))
+
+	serverKeyPair, err := tls.X509KeyPair([]byte(serverCert), []byte(serverKey))
+	assert.NoError(err)
+
+	serverCfg := tls.Config{
+		Certificates: []tls.Certificate{serverKeyPair},
+		MinVersion:   tls.VersionTLS12,
+		ClientAuth:   tls.RequestClientCert,
+	}
+
+	erinKeyPair, err := tls.X509KeyPair([]byte(erinCert), []byte(erinKey))
+	assert.NoError(err)
+
+	erinCfg := tls.Config{
+		Certificates:       []tls.Certificate{erinKeyPair},
+		InsecureSkipVerify: true,
+	}
+
+	davidKeyPair, err := tls.X509KeyPair([]byte(davidCert), []byte(davidKey))
+	assert.NoError(err)
+
+	davidCfg := tls.Config{
+		Certificates:       []tls.Certificate{davidKeyPair},
+		InsecureSkipVerify: true,
+	}
+
+	socketPath := fmt.Sprintf("/tmp/%s.socket", t.Name())
+
+	localListener, err := net.Listen("unix", socketPath)
+	assert.NoError(err)
+	defer os.Remove(socketPath)
+
+	tlsListener := tls.NewListener(localListener, &serverCfg)
+	defer tlsListener.Close()
+
+	for _, data := range []struct {
+		clientCfg tls.Config
+		pattern   string
+	}{
+		{erinCfg, "^30 /users\r\n$"},
+		{davidCfg, "^40 Registration is closed for .+\r\n$"},
+	} {
+		unixReader, err := net.Dial("unix", socketPath)
+		assert.NoError(err)
+		defer unixReader.Close()
+
+		tlsWriter, err := tlsListener.Accept()
+		assert.NoError(err)
+
+		tlsReader := tls.Client(unixReader, &data.clientCfg)
+		defer tlsReader.Close()
+
+		var wg sync.WaitGroup
+		wg.Add(2)
+		go func() {
+			assert.NoError(tlsReader.Handshake())
+			wg.Done()
+		}()
+		go func() {
+			assert.NoError(tlsWriter.(*tls.Conn).Handshake())
+			wg.Done()
+		}()
+		wg.Wait()
+
+		_, err = tlsReader.Write([]byte("https://localhost.localdomain/users/register\r\n"))
+		assert.NoError(err)
+
+		gemini.Handle(context.Background(), front.NewHandler(), tlsWriter, db, fed.NewResolver(nil), &wg, slog.Default())
+
+		tlsWriter.Close()
+
+		resp, err := io.ReadAll(tlsReader)
+		assert.NoError(err)
+
+		assert.Regexp(data.pattern, string(resp))
+	}
+}
+
+func TestRegister_Throttling30Minutes(t *testing.T) {
+	assert := assert.New(t)
+
+	dbPath := fmt.Sprintf("/tmp/%s.sqlite3?_journal_mode=WAL", t.Name())
+	db, err := sql.Open("sqlite3", dbPath)
+	assert.NoError(err)
+	defer os.Remove(dbPath)
+
+	assert.NoError(migrations.Run(context.Background(), slog.Default(), db))
+
+	serverKeyPair, err := tls.X509KeyPair([]byte(serverCert), []byte(serverKey))
+	assert.NoError(err)
+
+	serverCfg := tls.Config{
+		Certificates: []tls.Certificate{serverKeyPair},
+		MinVersion:   tls.VersionTLS12,
+		ClientAuth:   tls.RequestClientCert,
+	}
+
+	erinKeyPair, err := tls.X509KeyPair([]byte(erinCert), []byte(erinKey))
+	assert.NoError(err)
+
+	erinCfg := tls.Config{
+		Certificates:       []tls.Certificate{erinKeyPair},
+		InsecureSkipVerify: true,
+	}
+
+	davidKeyPair, err := tls.X509KeyPair([]byte(davidCert), []byte(davidKey))
+	assert.NoError(err)
+
+	davidCfg := tls.Config{
+		Certificates:       []tls.Certificate{davidKeyPair},
+		InsecureSkipVerify: true,
+	}
+
+	socketPath := fmt.Sprintf("/tmp/%s.socket", t.Name())
+
+	localListener, err := net.Listen("unix", socketPath)
+	assert.NoError(err)
+	defer os.Remove(socketPath)
+
+	tlsListener := tls.NewListener(localListener, &serverCfg)
+	defer tlsListener.Close()
+
+	for _, data := range []struct {
+		clientCfg tls.Config
+		pattern   string
+	}{
+		{erinCfg, "^30 /users\r\n$"},
+		{davidCfg, "^40 Registration is closed for .+\r\n$"},
+	} {
+		unixReader, err := net.Dial("unix", socketPath)
+		assert.NoError(err)
+		defer unixReader.Close()
+
+		tlsWriter, err := tlsListener.Accept()
+		assert.NoError(err)
+
+		tlsReader := tls.Client(unixReader, &data.clientCfg)
+		defer tlsReader.Close()
+
+		var wg sync.WaitGroup
+		wg.Add(2)
+		go func() {
+			assert.NoError(tlsReader.Handshake())
+			wg.Done()
+		}()
+		go func() {
+			assert.NoError(tlsWriter.(*tls.Conn).Handshake())
+			wg.Done()
+		}()
+		wg.Wait()
+
+		_, err = tlsReader.Write([]byte("https://localhost.localdomain/users/register\r\n"))
+		assert.NoError(err)
+
+		gemini.Handle(context.Background(), front.NewHandler(), tlsWriter, db, fed.NewResolver(nil), &wg, slog.Default())
+
+		tlsWriter.Close()
+
+		resp, err := io.ReadAll(tlsReader)
+		assert.NoError(err)
+
+		assert.Regexp(data.pattern, string(resp))
+
+		_, err = db.Exec(`update persons set inserted = unixepoch() - 1800`)
+		assert.NoError(err)
+	}
+}
+
+func TestRegister_Throttling1Hour(t *testing.T) {
+	assert := assert.New(t)
+
+	dbPath := fmt.Sprintf("/tmp/%s.sqlite3?_journal_mode=WAL", t.Name())
+	db, err := sql.Open("sqlite3", dbPath)
+	assert.NoError(err)
+	defer os.Remove(dbPath)
+
+	assert.NoError(migrations.Run(context.Background(), slog.Default(), db))
+
+	serverKeyPair, err := tls.X509KeyPair([]byte(serverCert), []byte(serverKey))
+	assert.NoError(err)
+
+	serverCfg := tls.Config{
+		Certificates: []tls.Certificate{serverKeyPair},
+		MinVersion:   tls.VersionTLS12,
+		ClientAuth:   tls.RequestClientCert,
+	}
+
+	erinKeyPair, err := tls.X509KeyPair([]byte(erinCert), []byte(erinKey))
+	assert.NoError(err)
+
+	erinCfg := tls.Config{
+		Certificates:       []tls.Certificate{erinKeyPair},
+		InsecureSkipVerify: true,
+	}
+
+	davidKeyPair, err := tls.X509KeyPair([]byte(davidCert), []byte(davidKey))
+	assert.NoError(err)
+
+	davidCfg := tls.Config{
+		Certificates:       []tls.Certificate{davidKeyPair},
+		InsecureSkipVerify: true,
+	}
+
+	socketPath := fmt.Sprintf("/tmp/%s.socket", t.Name())
+
+	localListener, err := net.Listen("unix", socketPath)
+	assert.NoError(err)
+	defer os.Remove(socketPath)
+
+	tlsListener := tls.NewListener(localListener, &serverCfg)
+	defer tlsListener.Close()
+
+	for _, data := range []struct {
+		clientCfg tls.Config
+		pattern   string
+	}{
+		{erinCfg, "^30 /users\r\n$"},
+		{davidCfg, "^30 /users\r\n$"},
+	} {
+		unixReader, err := net.Dial("unix", socketPath)
+		assert.NoError(err)
+		defer unixReader.Close()
+
+		tlsWriter, err := tlsListener.Accept()
+		assert.NoError(err)
+
+		tlsReader := tls.Client(unixReader, &data.clientCfg)
+		defer tlsReader.Close()
+
+		var wg sync.WaitGroup
+		wg.Add(2)
+		go func() {
+			assert.NoError(tlsReader.Handshake())
+			wg.Done()
+		}()
+		go func() {
+			assert.NoError(tlsWriter.(*tls.Conn).Handshake())
+			wg.Done()
+		}()
+		wg.Wait()
+
+		_, err = tlsReader.Write([]byte("https://localhost.localdomain/users/register\r\n"))
+		assert.NoError(err)
+
+		gemini.Handle(context.Background(), front.NewHandler(), tlsWriter, db, fed.NewResolver(nil), &wg, slog.Default())
+
+		tlsWriter.Close()
+
+		resp, err := io.ReadAll(tlsReader)
+		assert.NoError(err)
+
+		assert.Regexp(data.pattern, string(resp))
+
+		_, err = db.Exec(`update persons set inserted = unixepoch() - 3600`)
+		assert.NoError(err)
+	}
+}
+
+func TestRegister_RedirectTwice(t *testing.T) {
+	assert := assert.New(t)
+
+	dbPath := fmt.Sprintf("/tmp/%s.sqlite3?_journal_mode=WAL", t.Name())
+	db, err := sql.Open("sqlite3", dbPath)
+	assert.NoError(err)
+	defer os.Remove(dbPath)
+
+	assert.NoError(migrations.Run(context.Background(), slog.Default(), db))
+
+	serverKeyPair, err := tls.X509KeyPair([]byte(serverCert), []byte(serverKey))
+	assert.NoError(err)
+
+	serverCfg := tls.Config{
+		Certificates: []tls.Certificate{serverKeyPair},
+		MinVersion:   tls.VersionTLS12,
+		ClientAuth:   tls.RequestClientCert,
+	}
+
+	erinKeyPair, err := tls.X509KeyPair([]byte(erinCert), []byte(erinKey))
+	assert.NoError(err)
+
+	clientCfg := tls.Config{
+		Certificates:       []tls.Certificate{erinKeyPair},
+		InsecureSkipVerify: true,
+	}
+
+	socketPath := fmt.Sprintf("/tmp/%s.socket", t.Name())
+
+	localListener, err := net.Listen("unix", socketPath)
+	assert.NoError(err)
+	defer os.Remove(socketPath)
+
+	tlsListener := tls.NewListener(localListener, &serverCfg)
+	defer tlsListener.Close()
+
+	for _, data := range []struct {
+		url      string
+		expected string
+	}{
+		{"https://localhost.localdomain/users\r\n", "^30 /users/register\r\n$"},
+		{"https://localhost.localdomain/users/register\r\n", "^30 /users\r\n$"},
+		{"https://localhost.localdomain/users\r\n", "^20 text/gemini\r\n.+"},
+		{"https://localhost.localdomain/users/register\r\n", "^40 Already registered as erin\r\n$"},
+	} {
+		unixReader, err := net.Dial("unix", socketPath)
+		assert.NoError(err)
+		defer unixReader.Close()
+
+		tlsWriter, err := tlsListener.Accept()
+		assert.NoError(err)
+
+		tlsReader := tls.Client(unixReader, &clientCfg)
+		defer tlsReader.Close()
+
+		var wg sync.WaitGroup
+		wg.Add(2)
+		go func() {
+			assert.NoError(tlsReader.Handshake())
+			wg.Done()
+		}()
+		go func() {
+			assert.NoError(tlsWriter.(*tls.Conn).Handshake())
+			wg.Done()
+		}()
+		wg.Wait()
+
+		_, err = tlsReader.Write([]byte(data.url))
+		assert.NoError(err)
+
+		gemini.Handle(context.Background(), front.NewHandler(), tlsWriter, db, fed.NewResolver(nil), &wg, slog.Default())
+
+		tlsWriter.Close()
+
+		resp, err := io.ReadAll(tlsReader)
+		assert.NoError(err)
+
+		assert.Regexp(data.expected, string(resp))
+	}
+}