REST API Protection

REST API Protection REST API Protection is a professional, multi-layered cybersecurity suite designed specifically to defend WordPress REST API endpoints against scraping, automated exploitation, injection attacks, and unauthorized access. Architecture and Features Layer 1: Firewall and Access Control - Hard Block Status: (Optional) Deny all REST API traffic by default except for authenticated Administrators and Whitelisted IP addresses. - IP Blacklisting: Permanently ban known malicious actors. Blacklist rules execute with priority zero before any other logic. - IP Whitelisting: Bypass all security rules and rate limits for trusted endpoints (e.g., origin servers, development teams, integrations). - Geo-Blocking: Deny traffic originating from configurable ISO 3166-1 alpha-2 country codes. Lookups are locally cached to maximize performance. - Namespace Blocking: Hide specific REST namespaces or routes (e.g., /wp/v2/users or /wc/v3) from public discovery, mitigating data leakage and user enumeration. - Proxy-Aware Resolution: Ensure accurate threat detection when running behind Cloudflare, Nginx proxies, or load balancers, defeating X-Forwarded-For spoofing. Layer 2: Behavioral