diff --git a/README.md b/README.md
index 696e66e..f190a43 100644
--- a/README.md
+++ b/README.md
@@ -1,17 +1,29 @@
-![Publish Status](https://github.com/ether/ep_post_data/workflows/Node.js%20Package/badge.svg) [![Backend Tests Status](https://github.com/ether/ep_post_data/actions/workflows/test-and-release.yml/badge.svg)](https://github.com/ether/ep_post_data/actions/workflows/test-and-release.yml)
+# ep_post_data
 
-# Post data straight to a pad
+POST data directly into an Etherpad pad via HTTP.
+
+## Install
 
-## Curl example
 ```
-curl -X POST -d @/tmp/xbmc.log http://10.0.0.215:9001/post
+pnpm run plugins i ep_post_data
 ```
 
-You can also use the 'x-pad-id' header to define the resulting pad name or it will be randomized. Ex:
-```
-$ curl -X POST -d @datafile.txt -H 'X-PAD-ID: test123' http://10.0.0.215/post
-Pad Created: http://10.0.0.215/p/test123
+## Usage
+
+POST to `/post` to create or update a pad. Set the `X-PAD-ID` header to choose the pad name, otherwise a random ID is generated.
+
+```bash
+# Create a pad with a random ID
+curl -X POST -d @datafile.txt http://localhost:9001/post
+
+# Create or update a specific pad
+curl -X POST -d @datafile.txt -H 'X-PAD-ID: mypad' http://localhost:9001/post
 ```
 
-## Limitation
-Etherpad Limits imports to 100k Characters
+## Limits
+
+Request body is capped at 1 MB.
+
+## License
+
+Apache-2.0
diff --git a/index.js b/index.js
index ebd0e78..169c138 100644
--- a/index.js
+++ b/index.js
@@ -3,6 +3,8 @@
 const API = require('ep_etherpad-lite/node/db/API.js');
 const randomString = require('ep_etherpad-lite/static/js/pad_utils').randomString;
 
+const MAX_BODY_SIZE = 1024 * 1024; // 1 MB
+
 exports.registerRoute = (hookName, args, callback) => {
   args.app.post('/post', (req, res) => {
     let padId = req.headers['x-pad-id'];
@@ -10,12 +12,18 @@ exports.registerRoute = (hookName, args, callback) => {
       padId = randomString(8);
     }
     let content = '';
+    let aborted = false;
 
     req.on('data', (data) => {
-      // Append data.
       content += data;
+      if (content.length > MAX_BODY_SIZE) {
+        aborted = true;
+        res.status(413).send('Request body too large');
+        req.destroy();
+      }
     });
     req.on('end', async () => {
+      if (aborted) return;
       let padExists = true;
       try {
         padExists = await API.getText(padId, 0);