WP Manifestindependent plugin directory
manifest / security / wp-rest-api-rate-limit

WP REST API Rate Limit

WordPress plugin: per-IP REST API rate limiting with strict auth-route buckets, 429 + Retry-After

by Azan Umer · github.com/azanumer/wp-rest-api-rate-limit

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/azanumer/wp-rest-api-rate-limit/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/azanumer/wp-rest-api-rate-limit ↗

Per-IP rate limiting for the WordPress REST API — zero dependencies, works on any host.

Why

The REST API is a favorite target: /wp/v2/users for user enumeration, comment endpoints for spam, JWT/token routes for credential stuffing. A WAF helps, but this plugin stops the abuse at the application layer with proper 429 + Retry-After responses.

Features

  • Two buckets — a general limit for all routes, plus a stricter limit for auth-sensitive routes (/wp/v2/users, comments, JWT/token/auth)
  • Proper HTTP 429 with a Retry-After header (bots and clients back off correctly)
  • CIDR allow-list (IPv4 + IPv6), admin bypass, per-day blocked-request counter
  • One-click counter reset; full cleanup on uninstall
  • Developer filter wprl_client_ip for sites behind a trusted proxy/Cloudflare — default is REMOTE_ADDR only, because blindly trusting X-Forwarded-For lets attackers rotate IPs

Usage

Install, activate, go to Settings → REST Rate Limit. Defaults (120/min general, 30/min strict, 60s window) are sane for most sites — tighten the strict bucket if you see enumeration attempts in your logs.

License

MIT — see LICENSE.