WC API Rate Limiter by Volade
Detén el testeo de tarjetas en la API REST de WooCommerce.
WC API Rate Limiter de Volade aplica cuotas en REST + Store API checkout — huella, 5 ajustes predefinidos, registro de peticiones bloqueadas y exportación JSON gratuita. Sin WAF externo necesario.
5 ajustes predefinidos, huella anti-IP rotatoria, sincronización Store API y registro 429 — sin cuenta.
5
Presets
30
Req/min (card testing)
JSON
Export free
429
Response standard
De un vistazo
Las tiendas WooCommerce exponen una API REST potente — y los bots de prueba de tarjetas la explotan. Ningún plugin de WordPress limita limpiamente `/wc/v3/orders` o `/customers` sin un WAF externo. WC API Rate Limiter by Volade aplica cuotas de ventana deslizante por IP, cuatro ajustes predefinidos (prueba de tarjetas, estándar, agencia, claves API), un registro 429 y exportación JSON gratuita. Lista blanca de IP, reglas por ruta y CSV con cuenta Volade conectada; resumen multisitio y WP-CLI en V+.
Capturas de pantalla
UI de administración real a página completa: ajustes predefinidos, diagnósticos y configuración detallada.
Por qué la API de WooCommerce es un objetivo
Testeo de tarjetas, scraping de catálogo, carga headless accidental — sin límites nativos de WooCommerce.
The problem: open API, zero quota
WooCommerce exposes orders and customers over REST — bots abuse it.
Card testing, customer enumeration, catalog scraping: your host sees thousands of POSTs on `/wc/v3/orders` before chargeback alerts.
- WooCommerce core: REST auth, but no built-in rate limiting
- Cloud WAF: perimeter-effective, often blind to per-route WC nuance
- Custom mu-plugins: fragile, unmaintained, no usable log
- Disabling REST: breaks headless, mobile apps and legit integrations
- Generic security plugins: do not target `/wc/v3/` with e-commerce presets
The WC API Rate Limiter answer
WooCommerce-native REST quotas — lightweight, logged, agency-ready.
A Volade plugin that limits per IP and sliding window, logs 429s and ships four business presets — no account for essentials.
- Card testing preset: REST + Store API checkout, hybrid fingerprint, WC native sync
- Card testing MAX: 15 req/min POST-only, pure fingerprint, connected auto-ban
- Scopes: card shield, sensitive, Store API, all WC, orders or customers
- Block log with IP, route, method and count/limit ratio
- Free JSON export — CSV and IP allowlist with Volade account
- X-RateLimit-Remaining headers for headless integrations
- wp warl status | export | clear — Site Health and WP-CLI
5 ajustes predefinidos, cero conjeturas
Card testing, Card testing MAX, estándar, agencia o claves API — REST + Store API.
Card testing shield
REST + Store API, hybrid fingerprint, WooCommerce sync — first line of defense.
RecomendadoCard testing MAX
15 req/min POST-only, pure fingerprint, auto-ban — active rotating-IP attacks.
UrgentWooCommerce standard
120 req/min on all `/wc/` routes — solid production default.
Live storeAgency multi-store
300 req/min with logging — staging imports without false positives.
AgenciaAPI keys only
500 req/min authenticated, anonymous capped at 60.
Headless4 ámbitos de protección
Desde el checkout sensible hasta todo /wc/ — elige a qué pueden acceder los bots.
Orders, customers, coupons, payment gateways — card testing target.
Full `/wc/` prefix — broad catalog and settings protection.
Only `/wc/v3/orders` — checkout and order creation.
Only `/wc/v3/customers` — enumeration and account creation.
Start with wc_sensitive in production — widen only if integrations require it.
Real scenarios
What merchants see after enabling.
B2C card testing
Antes: 200 POST/min on orders from 3 IPs — chargebacks 48h later
Después: 429 at 30 req/min, IPs logged, JSON export to host
Fewer chargebacks
Agency headless + Woo
Antes: Staging overloads prod via unthrottled API sync
Después: Agency preset 300/min + office IP allowlist
Stable sync
Dokan marketplace
Antes: Vendor scraping via customers API
Después: Customers scope + 7-day log
Data protected
La protección API que WooCommerce nunca incluyó
Cuotas REST nativas dentro de WordPress — no un WAF en la nube, no código mu-plugin frágil.
Per-IP quotas
Configurable sliding window — WordPress transients, no Redis required.
4 ajustes predefinidos
Card testing, standard, agency, API keys — one click in admin.
429 log
IP, route, method, user agent and count/limit — exportable.
Exportación JSON
Free incident report — CSV and filters with Volade account.
IP allowlist
Office, staging, ERP partner — bypass without disabling the plugin.
Site Health
Direct test in Tools → Site Health — blocked/allowed 24h.
WP-CLI
warl status, export, clear — agency scripts and CI.
Volade SDK
Discover, XP, V+ premium — same charter as other Volade extensions.
Combínalo con el WAF de tu hosting — WARL se centra en las rutas REST de WooCommerce desde dentro de WordPress.
Honest comparison
WARL vs cloud WAF vs bare REST vs custom code.
| Característica | WARL | Cloud WAF | WC REST only | Custom code |
|---|---|---|---|---|
| Limits on /wc/v3/orders | ~ | ~ | ||
| Presets card testing | ~ | |||
| Journal blockings exploitable | ~ | ~ | ||
| Export JSON sans compte | ||||
| IP allowlist per route | ~ | |||
| Store API checkout sync | ~ | ~ | ~ | |
| Fingerprint (rotating IP) | ~ | ~ | ||
| Temporary IP auto-ban | ~ | ~ | ||
| No external infra | ||||
| Cost | Free | $$$ | Free | Temps dev |
WARL complements a WAF — it knows WooCommerce routes and card testing presets.
Tres niveles, un plugin
Límites, ajustes predefinidos y JSON gratuitos sin cuenta. Cuenta Volade y V+ para lista blanca, rutas y multisitio.
Sin cuenta
- 4 ajustes predefinidos
- Core limits
- 100-entry log
- Exportación JSON
- Site Health
Cuenta Volade
- IP allowlist
- Per-route rules
- CSV export
- X-RateLimit headers
- 1,000-entry log
V+ Premium
- 10,000-entry log
- WP-CLI bulk
- Multisite rollup
- Premium on full roadmap
- Priority support
WP-CLI y multisitio para auditar bloqueos en todas las tiendas de la red.
WP-CLI
Automate status and exports over SSH — agency-friendly.
wp warl status wp warl export --file=blocked.json wp warl clear --yes
Multisitio
V+ centralizes block visibility across every site in the network.
- Network dashboard (V+)
- Consolidated export
- Synced presets
- API load alerts
Descargar
Instala el ZIP, aplica Card testing shield — primera protección en menos de dos minutos.
ZIP con SDK de Volade incluido — activa en Volade → API Rate Limiter (o WooCommerce → API Rate Limiter).
- 1Plugins → Añadir nuevo → Subir → selecciona el ZIP → Activar
- 2Volade → API Rate Limiter (or WooCommerce → API Rate Limiter)
- 3Aplicar Card testing shield → ver el registro → exportar JSON si es necesario
Primer límite activo en menos de 2 minutos
Preguntas frecuentes
WAF, WooCommerce REST, testeo de tarjetas, cuenta Volade y V+.
No — WARL is WooCommerce-native. Keep your WAF; add WARL for `/wc/` routes and business logging.
Gratis vs V+ Premium
La extensión funciona sin cuenta. V+ desbloquea premium en esta extensión y en todo el catálogo.
| Característica | Gratis | V+ |
|---|---|---|
| 4 préréglages & limites de base | ||
| Journal requêtes bloquées & JSON | ||
| Site Health & scopes WC REST | ||
| Règles par route & allowlist IP | ||
| Export CSV & en-têtes X-RateLimit | ||
| WP-CLI bulk & rollup multisite |
Reseñas, debates y novedades
Comparte tu experiencia con WC API Rate Limiter by Volade y sigue las últimas versiones.
Protect your WooCommerce API
Download WC API Rate Limiter by Volade v1.0.0 — Card testing preset in one click, no signup.
Descargar v1.0.0