Tune or bypass the per-IP REST rate limiter

Premium Intermediate

Two situations call for this recipe. First: your add-on registers a REST endpoint that legitimately receives higher traffic than the default bucket allows, and your clients are getting 429 responses they don’t deserve — raise or add a bucket for that route. Second: a trusted upstream (your own backend, a license server, a known service) is being blocked even though it shouldn’t be — skip the limiter for that caller entirely. Route patterns are matched most-specific first, so your custom bucket must come before the standard catch-all.

Code

<?php
add_filter( 'benecaster_rest_rate_limit_buckets', function ( array $buckets ): array {
    // Most-specific patterns must come before the 'standard' catch-all.
    array_unshift( $buckets, [
        'key'        => 'myaddon_export',
        'limit'      => 5,
        'window'     => 3600,
        'identifier' => 'ip', // or 'user' to partition per logged-in user
        'routes'     => [ '#^/benecaster/v1/myaddon/export$#' ],
        'methods'    => [ 'POST' ],
    ] );
    return $buckets;
} );

add_filter( 'benecaster_rest_rate_limit_skip', function ( bool $skip, \WP_REST_Request $request ): bool {
    $signature = $request->get_header( 'X-MyAddon-Signature' );
    return $signature && hash_equals( my_addon_expected_signature( $request ), $signature );
}, 10, 2 );

View on GitHub →

Hooks Used

Need this built rather than just documented? See our services →