# Decision tree — WC API Rate Limiter preset

## Volade · Public resource

```
                    [WooCommerce store in production]
                                    |
                    ┌───────────────┴───────────────┐
                    |                               |
         Active card testing signs?          No visible attack
         (declines, micro-orders)                     |
                    | YES                               |
                    v                                   v
         ┌──────────────────┐              Using WC REST in production?
         | card_testing     |              (headless, ERP, mobile app)
         | 30 req/min       |                        |
         | wc_sensitive     |           ┌────────────┴────────────┐
         └──────────────────┘           | YES                     | NO
                    |                   v                         v
                    |          Authenticated API keys?    Staging / bulk
                    |                   |                  import?
                    |        ┌──────────┴──────────┐              |
                    |        | YES                 | NO          |
                    |        v                     v              v
                    |   ┌─────────┐         ┌────────────┐  ┌──────────┐
                    |   | api_keys|         | woocommerce|  | agency   |
                    |   | 500/min |         | 120/min    |  | 300/min  |
                    |   └─────────┘         | wc_all     |  | wc_all   |
                    |                       └────────────┘  └──────────┘
                    |                             |
                    └─────────────┬───────────────┘
                                  v
                    False positives after 24 h?
                                  |
                    ┌─────────────┴─────────────┐
                    | YES                       | NO
                    v                           v
         Step up preset OR allowlist          Keep preset +
         ERP / agency IPs                     monthly log review
```

## Preset legend

| Preset | Requests / 60 s | Routes |
|--------|-----------------|--------|
| card_testing | 30 | orders, customers, coupons, payment_gateways |
| woocommerce | 120 | all `/wc/` |
| agency | 300 | all `/wc/` |
| api_keys | 500 | all `/wc/` (higher for authenticated keys) |

**Plugin:** [WC API Rate Limiter by Volade](https://volade.com/en/cms/wordpress/extensions/wc-api-rate-limiter-by-volade)