包简介

Security Suite for WordPress REST API (Anti-Reconnaissance & Hardening).

README 文档

README

REST API Protection is a professional, multi-layered cybersecurity suite designed specifically to defend WordPress REST API endpoints against scraping, automated exploitation, injection attacks, and unauthorized access.

Architecture and Features

Layer 1: Firewall and Access Control

Hard Block Status: (Optional) Deny all REST API traffic by default except for authenticated Administrators and Whitelisted IP addresses.
IP Blacklisting: Permanently ban known malicious actors. Blacklist rules execute with priority zero before any other logic.
IP Whitelisting: Bypass all security rules and rate limits for trusted endpoints (e.g., origin servers, development teams, integrations).
Geo-Blocking: Deny traffic originating from configurable ISO 3166-1 alpha-2 country codes. Lookups are locally cached to maximize performance.
Namespace Blocking: Hide specific REST namespaces or routes (e.g., /wp/v2/users or /wc/v3) from public discovery, mitigating data leakage and user enumeration.
Proxy-Aware Resolution: Ensure accurate threat detection when running behind Cloudflare, Nginx proxies, or load balancers, defeating X-Forwarded-For spoofing.

Layer 2: Behavioral Defense

Rate Limiting: Granular, sliding-window rate tracking. Automatically temporarily ban IP addresses that exceed request thresholds.
Security Headers: Automatically injects strict HTTP response headers into all REST communications (X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, X-XSS-Protection, etc.).
Troll Mode: (Optional) Replaces standard JSON 403 blocks with obfuscated terminal-like browser responses and CLI decoys to frustrate automated scanners and waste threat actor resources.

Layer 3: Auditing and Monitoring

Intrusion Dashboards: Visual metrics on blocked interactions, rate limit violations, and security events.
Detailed Forensic Logs: Track IP, Request Type (Block, Rate, Geo, NS), Request URL, and User-Agent.
Data Export: Secure, nonce-protected CSV export for external Security Information and Event Management (SIEM) ingestion.

Installation

Option 1: Composer (Recommended)

composer require kevorteg/wp-api-protection

Option 2: Manual

Download the latest release (wp-api-protection.zip).
Upload the uncompressed directory to /wp-content/plugins/wp-api-protection/.
Activate the plugin through the WordPress Administration interface.
Navigate to API Protection in the main sidebar to configure firewall policies.

Operations Guide

Component	Default	Configuration Context
Hard Block Mode	Enabled	Disable if Public REST access is required for unauthenticated operations.
Security Headers	Enabled	Recommended to leave enabled for baseline security.
Rate Limiter	30 requests / 60s	Adjust based on normal web application consumption.
Block Duration	3600 seconds	Penalty duration for rate limit violations.
Alert Threshold	20 triggers / 5 min	Threshold for alerting the site administrator via email.

Contributing

This project is released open source under the GPLv2 (or later) license. Security patches, pull requests, and vulnerability disclosures are welcome via GitHub.

Authors: Kevin Ortega

kevorteg/wp-api-protection 适用场景与选型建议

kevorteg/wp-api-protection 是一款基于 PHP 开发的 Composer 扩展包，目前已累计 0 次下载、GitHub Stars 达 1，最近一次更新时间为 2026 年 01 月 20 日，在 PHP 生态内属于活跃度较高的组件。

它主要适用于以下技术方向：「security」「wordpress」「firewall」「rest-api」「hardening」等业务场景。在实际项目中，围绕这些方向常见需要落地的问题包括：接口对接、性能调优、并发安全、与既有框架（Laravel / ThinkPHP / Yii / Webman 等）的兼容适配，以及生产环境的日志埋点与稳定性保障。

我们在过去多个企业项目中使用过 kevorteg/wp-api-protection 或与其功能相近的方案，如果你在选型或落地过程中遇到问题，例如 版本兼容、二次改造、私有化封装、与内部系统对接、生产 BUG 排查，欢迎联系我们协助评估。

围绕 kevorteg/wp-api-protection 我们能提供哪些服务？

定制开发 / 二次开发

基于 kevorteg/wp-api-protection 在你已有业务上做功能扩展、字段裁剪、UI 适配、与内部账号 / 权限 / 日志系统的深度对接。

BUG 修复 & 性能优化

线上偶发问题、内存泄漏、慢查询、并发异常等排查修复；针对高流量场景做缓存、队列、索引层面的调优。

项目外包 & 长期维护

承接完整的项目从需求 → 设计 → 开发 → 上线 → 长期运维；也可按月提供技术保姆服务。

yvsm@zunyunkeji.com QQ：316430983 微信：yvsm316 西安尊云信息科技 · 专注 PHP / Go / 分布式系统研发

与 kevorteg/wp-api-protection 相关的其它包

同方向 / 同关键字的高下载量 PHP Composer 包推荐，方便对比选型：

nguyenanhung/basic-firewall 6

PHP Basic Firewall

sil/route-security-bundle 7

Provide a way to secure accesses to all routes of an symfony application.

eftec/securityonemysql 6

It's a barebone security class written on PHP

bugbuster/integrity_check 3

Contao CMS integrity check for some files

vartroth/php-security-lint 0

A PHP security linter to detect insecure functions like var_dump, print_r, and other dangerous functions in your codebase

agenter-labs/laravel-firewall 0

Web Application Firewall (WAF) package for Laravel

kevorteg/wp-api-protection

包简介

关键字：