Progressive, time-aware rate limiting for WordPress. Stop brute force attacks, API abuse, and bot traffic while allowing legitimate users and search engines.
Admin Interface Preview
What this plugin stops
Enterprise-grade protection, completely free
Built with production environments in mind, featuring sophisticated rate limiting algorithms and intelligent bot detection.
Automatically protects wp-login.php, xmlrpc.php, admin-ajax.php, and wp-json/* endpoints
First violations get short blocks (2 min), repeat offenses get exponentially longer blocks (up to 60 min)
Automatically allows legitimate Google/Bing bots using reverse DNS verification
Enforces stricter limits during busy daytime hours, relaxes them at night
Network-wide defaults with per-site overrides for WordPress Multisite installations
Production-ready with atomic counters for high-traffic environments
Sophisticated two-bucket counting system
Uses two overlapping 1-minute buckets (current and previous) to approximate a sliding window. This prevents the "reset spike" problem where attackers could send bursts of requests right after a fixed window resets.
A request is exempted only if the user agent contains known bot identifiers, reverse DNS ends with expected domains (e.g., .googlebot.com), and forward DNS resolves back to the same IP. Results are cached for 7 days.
Easy setup as a must-use plugin
Download from GitHub
Clone or download the repository from github.com/fuzzywalrus/wordpress-rate-limiter
Place in mu-plugins directory
Copy the plugin file to wp-content/mu-plugins/netrl.php
Configure settings
Access Settings → Rate Limiter in WordPress admin to configure thresholds, allowlists, and monitoring
What you need
Join developers using Network Rate Limiter to stop attacks and keep their sites secure.