diff --git a/src/proxy.ts b/src/proxy.ts
index c625108..714b46b 100644
--- a/src/proxy.ts
+++ b/src/proxy.ts
@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { getToken } from "next-auth/jwt";
+import { rateLimit } from "@/lib/rate-limit";
 
 export async function proxy(request: NextRequest) {
   const pathname = request.nextUrl.pathname;
@@ -71,9 +72,22 @@ export async function proxy(request: NextRequest) {
     }
   }
 
+  // ── PUBLIC QUOTE ROUTES (rate limited) ───────────────────────────────────
+  if (pathname.match(/^\/quote\/[a-zA-Z0-9_-]{21}\/?$/)) {
+    const ip = request.headers.get("x-forwarded-for") || request.headers.get("x-real-ip") || "unknown";
+    const allowed = rateLimit(ip, 3, 60 * 1000); // 3 views per minute
+
+    if (!allowed) {
+      return NextResponse.json(
+        { error: "Troppi accessi. Riprova tra un minuto." },
+        { status: 429 }
+      );
+    }
+  }
+
   return NextResponse.next();
 }
 
 export const config = {
-  matcher: ["/admin/:path*", "/client/:path*"],
+  matcher: ["/admin/:path*", "/client/:path*", "/quote/:path*"],
 };