WordPress REST API Limits in the UK for 2026
16 August 2026
Learn about WordPress REST API limits in the UK for 2026, including rate limits, security, and performance tips to avoid throttling.
Understanding REST API Limits
The WordPress REST API is a powerful way to interact with your site, but it isn't unlimited. Every request consumes server resources. The default limit is often 25 requests per second per IP, but this varies by host and plugin. In the UK, shared hosting environments tend to be stricter, especially during peak London traffic hours. Knowing these limits helps you prevent 429 errors and keep your content accessible to British users. We'll break down what limits mean and how they impact your site's performance.
UK Hosting Provider Limits
UK hosting providers like Kinsta, Cloudways, and SiteGround apply their own REST API limits to protect shared infrastructure. For example, Kinsta limits REST API calls to 90 per minute per site on some plans. SiteGround may throttle beyond 500 requests per minute. If you're running a WooCommerce store or a membership site in the UK, these caps affect your ability to sync data with external apps. Always check your provider's fair usage policy. Some UK hosts offer dedicated servers with no hard limits, but you'll need to pay a premium.
Authentication and Rate Limiting
The REST API treats authenticated and unauthenticated requests differently. Unauthenticated requests are often rate-limited harder, especially for login endpoints. In the UK, after GDPR, security plugins like Wordfence and iThemes Security add extra limits to prevent brute-force attacks. Use API authentication methods like OAuth 2.0 or API keys to get higher quotas. Also, ensure your requests come from a single IP address. Many UK businesses use static IPs from office broadband to avoid being throttled together with other users.
Performance and Caching for UK Sites
Caching is your best weapon against hitting WordPress REST API limits. For UK audiences, use a CDN with edge caching located in London or Manchester to serve repeated responses without touching your origin server. Object caching with Redis or Memcached reduces database queries, lowering API load. Also, consider using batch requests or the 'embed' parameter to reduce the number of API calls. A well-optimised API can handle 10 times more traffic without raising limits, which is crucial for high-traffic e-commerce sites in the UK.
How to Bypass Limits Legitimately
If your legitimate use case requires more API calls, you have options. First, install a plugin like WP Rate Limiting to customise thresholds. Second, contact your UK host to request a temporary increase or move to a VPS. Third, use the 'X-RateLimit-Remaining' headers to monitor usage. Avoid writing custom loops that make a hundred requests per page. Instead, batch data via Cron jobs. For developers, remember that British web standards expect fair use; never abuse endpoints like /wp-json/wp/v2/users, which can expose author data and violate UK data protection principles.
FAQ
WordPress itself has no hard-coded rate limit. It depends on your server configuration and hosting provider. Many UK shared hosts throttle at around 25 requests per second per IP. Plugins like WPS Hide Login or Wordfence can add stricter limits, especially on authentication endpoints, to prevent abuse and brute-force attacks.