Tune or bypass the per-IP REST rate limiter

Free Intermediate Since v1.0.0

RateLimiter short-circuits over-quota requests on /benecaster/v1/ routes with 429 + Retry-After before any controller runs. benecaster_rest_rate_limit_buckets lets add-ons raise the catch-all bucket or add a custom bucket for an add-on endpoint. Most-specific patterns must come before the 'standard' catch-all. benecaster_rest_rate_limit_skip bypasses the limiter for trusted upstreams (known IPs, signed service-to-service requests). Identifier ip hashes REMOTE_ADDR — raw IPs are never stored.

Code

<?php
add_filter( 'benecaster_rest_rate_limit_buckets', function ( array $buckets ): array {
    // Most-specific patterns must come before the 'standard' catch-all.
    array_unshift( $buckets, [
        'key'        => 'myaddon_export',
        'limit'      => 5,
        'window'     => 3600,
        'identifier' => 'ip', // or 'user' to partition per logged-in user
        'routes'     => [ '#^/benecaster/v1/myaddon/export$#' ],
        'methods'    => [ 'POST' ],
    ] );
    return $buckets;
} );

add_filter( 'benecaster_rest_rate_limit_skip', function ( bool $skip, \WP_REST_Request $request ): bool {
    $signature = $request->get_header( 'X-MyAddon-Signature' );
    return $signature && hash_equals( my_addon_expected_signature( $request ), $signature );
}, 10, 2 );

Hooks Used

benecaster_rest_rate_limit_buckets
benecaster_rest_rate_limit_skip