What's a good rate limit for a UK WordPress site?

There's no one-size-fits-all figure. For a typical blog or small business site, allowing 60 requests per minute per IP is reasonable. For WooCommerce stores, you might allow higher limits for authenticated users. It's best to monitor your normal traffic and start with a conservative limit, then adjust to avoid blocking legitimate users.

Will throttling affect my site's SEO?

If you throttle but allow search engine bots, SEO won't be harmed. Make sure to whitelist known crawlers like Googlebot and Bingbot. Also, do not throttle authenticated users if they're your own authors or editors. When in doubt, test with Google Search Console's URL Inspector to see if your page loads correctly.

Can I throttle specific REST API endpoints?

Yes, you can target specific routes by checking the request route in your throttling callback. For example, you might want to limit /wp-json/wp/v2/comments more strictly than /wp-json/wp/v2/posts. Custom code gives you the flexibility to define per-endpoint limits.

Are there UK-specific WordPress hosting providers with built-in API throttling?

Some UK managed WordPress hosts like Krystal, 20i, and UKFast offer server-level protections, but they may not expose API throttling as a direct feature. Many rely on tools like ModSecurity or server-side rate limiting. Always ask their support team about REST API protection options.

WordPress REST API Throttling: The 2026 UK Guide

17 August 2026

Learn how to throttle the WordPress REST API in 2026. UK-specific tips on rate limiting, security, and performance for WordPress sites.

Read this page in: Deutsch

What is REST API throttling and why it matters for UK WordPress sites?

REST API throttling, or rate limiting, controls how many requests a client can make to your WordPress site's API within a set period. For UK websites, this is essential for preventing server overload, brute-force attacks, and excessive data scraping. Without throttling, a single rogue script can hammer your wp-json endpoint, causing slow page loads for genuine visitors. In 2026, with rising cyber threats and cost-sensitive hosting in the UK, implementing a fair-use policy for your API is a smart way to keep your site responsive, protect your server resources, and ensure a stable experience for users across the UK and beyond. This is particularly important if you run a WooCommerce store or a membership site.

UK legal considerations: GDPR, data protection, and rate limiting

When throttling the WordPress REST API, UK site owners must remember GDPR and the Data Protection Act 2018. Rate limiting often involves logging IP addresses and timestamps, which can constitute personal data. Therefore, you should assure your privacy policy, store logs securely, and delete them after a defined period. Additionally, the UK's Information Commissioner's Office (ICO) expects you to take appropriate technical measures to protect user data. Throttling is actually a great measure to prevent unauthorised access and data breaches. However, be transparent with your users about what you collect. Also, if you use a CDN or proxy, ensure you mask or handle X-Forwarded-For headers correctly to avoid bypassing your limits.

How to throttle WordPress REST API using plugins (UK-friendly options)

For most UK WordPress users, starting with a plugin is easiest. Popular options include WP Limit Login Attempts, but for REST API specifically, plugins like 'WP REST API Rate Limiting' or 'Limit Login Attempts Reloaded' offer simple controls. Alternatively, you can use security plugins like Wordfence or Sucuri, which include API throttling features. If you run a WooCommerce store, consider a plugin that integrates with payment gateways like Stripe or PayPal, often used in the UK. When choosing a plugin, make sure it's compatible with your PHP version and doesn't conflict with your caching layer. Also, look for settings that allow you to define a whitelist for known bots, such as Googlebot, to avoid harming your search visibility.

Custom PHP code for REST API rate limiting with UK hosting

If you want more control, adding a custom function to your theme's functions.php or a custom plugin is the way to go. In 2026, many UK developers prefer lightweight code over heavy plugins. A simple approach is to hook into 'rest_authentication_errors' or use the 'rest_pre_dispatch' filter to check a transient-based counter. For example, you can store the user's IP and count requests in the last minute. If they exceed a set threshold, return a WP_Error with a 429 status. Remember to respect the 'X-Real-IP' header if your UK host uses a reverse proxy. Also, set proper caching headers and use the built-in WP_Transient API to avoid database load. This method gives you full control without third-party bloat.

Testing your throttling setup and monitoring performance

After implementing throttling, you must test it thoroughly. Use tools like Apache JMeter, Postman, or an online load tester to simulate traffic from UK IP addresses. Check that you receive HTTP 429 responses when limits are exceeded. Also, verify that legitimate requests, like those from PayPal or government gateways, are not blocked. Monitor your server logs and WordPress debug.log for any errors. In the UK, it's common to use UptimeRobot or Pingdom to track site availability. Additionally, enable caching at the server level or use a CDN with edge caching to reduce the number of API calls reaching your origin. Regularly review your throttle settings and adjust based on real traffic patterns to maintain performance.

FAQ

No, WordPress core does not include built-in throttling for the REST API. However, you can implement it with custom code or by using plugins and security tools. Many managed UK WordPress hosts may offer rate limiting as part of their server-level protections, but it's not standard in WordPress core.

wordpress rest api rate limit wordpress api throttle plugin rest api security uk

Latest guides

Behavioural Questions Civil Service Jobs 2026 Guide Civil Service Behaviour Framework Levels: 2026 Guide Applying for Civil Service Jobs with Behaviours in 2026 Civil Service Personal Statement Example UK 2026 Civil Service Application Sift Criteria 2026: Pass the Sift Stores — Best Options in the UK (2026)