Download the PHP package cedaro/wprestcop without Composer
On this page you can find all versions of the php package cedaro/wprestcop. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download cedaro/wprestcop
More information about cedaro/wprestcop
Files in cedaro/wprestcop
Package wprestcop
Short Description A WordPress plugin for managing access to the WP REST API.
License GPL-2.0+
Homepage https://github.com/cedaro/wprestcop
Informations about the package wprestcop
WP REST Cop
Manage access to the WP REST API with rate limits and IP-based rules.
Contributors: Brady Vercher Requires: WP 4.4+, PHP 5.4+ Tested up to: 4.4 License: GPL-2.0+
Rate Limits
Rate limits allow for configuring the number of requests a client can make within a certain interval. The default in WP Rest Cop is 500 requests per hour.
The rate limit functionality requires a persistent object cache.
Headers
A few headers are sent with every request so clients can keep track of their current limit:
Header | Description |
---|---|
X-RateLimit-Limit |
Requests allowed per interval. |
X-RateLimit-Remaining |
Remaining requests allowed in the current interval. |
X-RateLimit-Reset |
Seconds until the limit is reset. |
If client has reached their limit, an additional header will be sent.
Header | Description |
---|---|
Retry-After |
Seconds until the limit is reset |
Clients may send a HEAD
request to view their current limit without ticking the meter.
Configuring Settings
Configure the default limit
and interval
settings using the simple API from the main plugin instance:
Settings can also be configured with the built-in WP CLI commands.
Disable Rate Limiting
If you just want the IP rules functionality and want to disable the rate limits, set the interval to -1
.
IP Rules
IP rules can be configured globally, or at the route level as a simple whitelist or blacklist.
Global Configuration
When allowing an IP address, the policy is to deny any requests from IPs not in the whitelist.
The opposite is true when denying IP addresses. All IPs not in the blacklist will have access.
Global IP rules can also be configured with the built-in WP CLI commands.
Route Configuration
Routes may also be configured with their own IP rules:
WP CLI Commands
A few WP CLI commands are included to configure the plugin without requiring code.
Command | Description |
---|---|
wp restcop allow <ip>... |
Whitelist one or more IPs. |
wp restcop check <ip> |
Check whether an IP has access. |
wp restcop deny <ip>... |
Blacklist one or more IPs. |
wp restcop set <key> <value> |
Update a setting value. |
wp restcop status |
View global IP rules. |
Potential Roadmap
- Support for logging various events.
- Additional rate limit strategies.
- More route-level capabilities.
- Advanced access rules.
- Administration UI.