woocommerce Case study
A2 REST Shield
A2 REST Shield is a small must-use plugin I wrote for our WooCommerce store after profiling showed anonymous REST traffic paying a heavy Elementor tax on every request. It short-circuits template queries during guest REST calls and caches a handful of expensive endpoints.
The business problem
Profiling showed that every guest hit on /wp-json/ was bootstrapping Elementor and running elementor_library post queries the response never used. Crawlers and integrations kept those routes warm around the clock, so the wasted queries turned into real database load. The catch: our wcpe product-extension routes genuinely need Elementor template lookups to register, so a blanket block would break them.
What I delivered
- A guest-only posts_pre_query filter that returns an empty result for elementor_library queries during REST requests, skipping the database entirely.
- An explicit exemption for /wcpe/ routes so their registration keeps working.
- Transient caching for a short allowlist of endpoints: /wp/v2/types, /wp/v2/taxonomies and /oembed/1.0 for 30 minutes, /wcpe/v1/products for 180 seconds.
- An X-A2-REST-CACHE response header (HIT, MISS-STORED, MISS-NOSTORE) so cache behavior can be verified straight from curl.
Technical approach
- Hooked rest_pre_dispatch and rest_post_dispatch instead of adding a page cache, keeping the caching inside the REST lifecycle and storing 200 responses only.
- Built cache keys from route, method and sorted query parameters so parameter order cannot split the cache.
- Guarded every code path with is_user_logged_in() and is_admin() checks; logged-in and admin traffic passes through untouched.
- Exposed the wcpe TTL through an a2_wcpe_rest_cache_ttl filter so it can be tuned without editing the plugin.
Result and evidence
REST p95 on the affected routes dropped from 2.8s to 0.9s. The shield is a single MU file, a2-rest-shield.php, currently at version 0.1.2 and running in production, with the cache header serving as a quick health check.
Commercial value
Cheaper REST responses let the store absorb crawler and integration traffic on the same hosting plan, and the product endpoints other systems rely on answer noticeably faster.
Readable implementation brief
implementation_brief {
project: "A2 REST Shield"
stack: "WordPress MU plugin, PHP, WooCommerce"
file: "mu-plugins/a2-rest-shield.php (v0.1.2)"
hooks: "posts_pre_query, rest_pre_dispatch, rest_post_dispatch"
scope: "guest REST only; wcpe routes and admin traffic exempt"
cache: "types/taxonomies/oembed 30min, wcpe products 180s"
header: "X-A2-REST-CACHE: HIT | MISS-STORED | MISS-NOSTORE"
result: "REST p95 2.8s -> 0.9s, running in production"
}What this project shows
This is the kind of fix I favor: measure first, then delete work the server should never have been doing. The whole plugin is under 200 lines, does one job and can be removed without leaving state behind.
A sanitized description of my private MU-plugin layer, including this module, is public in the mu-plugins-showcase repository on GitHub.