Rate Limiting
Rate limiting for checkout, API, login, admin, and admin AJAX endpoints to prevent abuse and brute force.
Rate limiting
Checkout Security includes rate limiting across multiple request types to prevent brute force attacks, checkout spam, and API abuse. Rate limits are tracked per IP address within configurable time windows.
Protected endpoints
| Endpoint | Description |
|---|---|
| Checkout | Limits checkout form submissions per IP to prevent automated checkout spam |
| API | Protects WordPress REST API endpoints from abuse |
| Login | Limits wp-login.php attempts to prevent brute force login attacks |
| Admin | Limits access to the wp-admin area to reduce automated admin probing |
| Admin AJAX | Limits admin-ajax.php requests to prevent AJAX-based abuse |
Configuration
yes.Configure rate limits separately for each endpoint type in the Checkout Security settings. Separate limits let you protect sensitive request types without applying the same threshold to every part of your site.
Rate limiting is enabled by default. Adjust limits based on your traffic patterns to avoid blocking legitimate customers during peak periods.
How it works
Rate limiting tracks requests from each IP address within a configured time window. When an IP address exceeds the configured request limit, Checkout Security blocks or delays subsequent requests until the window resets.
Limits are independent for each endpoint type. A high volume of checkout requests does not affect the rate limit for login requests, API requests, admin access, or admin AJAX requests.
Interactions
Rate limiting violations can contribute to the fraud risk score. Repeated violations may therefore trigger additional fraud controls, such as CAPTCHA, order review, or blocking, depending on the resulting risk level.
Whitelisted IP addresses may be exempt from certain rate limits. Trusted devices and users may also receive relaxed limits based on your trust and whitelist configuration.