Protecting API Endpoints

API endpoints are particularly exposed to credential stuffing, rate limit bypass, and aggressive scraping.

What does HEIMWALL do automatically?

Managed Rules automatically block API-targeted SQL injection, XSS, and scanner attacks based on signatures. The Threat List stops known malicious IPs. The rules below add credential-stuffing-specific and API-abuse-specific defences on top of these automatic layers.

Basic Rules

# Strict rate limit for POST /login
IF   http.request.method == POST
AND  http.request.base_uri == /login
THEN ratelimit 20/60s

# CAPTCHA for API requests from hosting/datacenter IPs
IF   http.request.base_uri has_prefix /api
AND  waf.client.ip_type == hosting
THEN captcha

# Increment failban counter on 401 responses (credential stuffing)
IF   http.response.status == 401
THEN failban

With these selections in the console:

• Rate limit the login — Field HTTP Method · Operator equals · Value POST AND Field Path (without query) · Operator equals · Value /login → Action Rate Limit (20 requests / 60 s)
• CAPTCHA for API requests from hosting IPs — Field Path (without query) · Operator starts with · Value /api AND Field IP Infrastructure Type · Operator equals · Value hosting → Action CAPTCHA
• Count 401s toward auto-ban — Field Origin Response Status · Operator equals · Value 401 → Action Auto-Block

The /login endpoint is the primary target of credential stuffing attacks. A limit of 20 requests per 60 seconds covers normal legitimate user behavior while effectively stopping automated brute-force attempts.

Data center and hosting IPs rarely originate from end users using a real browser. Routing requests to API endpoints from these sources through CAPTCHA narrows the attack surface without accidentally blocking legitimate B2B partner systems.

failban increments a counter on every 401 Unauthorized response. IPs that exceed the threshold are automatically blocked. This mechanism is especially effective against credential stuffing tools that achieve partial success, since errors accumulate and eventually trigger the block.

Advanced Variant

# Block requests missing an API key
IF   http.request.base_uri has_prefix /api
AND  http.header not_contains Authorization=
THEN block

# Catch bots making very rapid sequential requests
IF   http.request.base_uri has_prefix /api
AND  waf.bot_score ge 70
THEN captcha

With these selections in the console:

• Block requests without an API key — Field Path (without query) · Operator starts with · Value /api AND Field Header · Operator does not contain · Value Authorization= → Action Block
• CAPTCHA for high bot-score API traffic — Field Path (without query) · Operator starts with · Value /api AND Field Bot Score (0–100) · Operator greater or equal · Value 70 → Action CAPTCHA

Blocking API requests that do not include an Authorization header cuts off the bulk of abuse before it ever reaches your authentication layer. Enable this only after confirming that all your clients send the Authorization header.

High bot-score API traffic is most likely a scraper or automated testing tool. Combining this layer with the basic rate limit rules above provides defense-in-depth against attacks.

Tips

• Use Bypass Rate Limit for trusted partner IPs
• Combining Auto-Block with an Origin Response Status == 401 condition is highly effective against credential stuffing
• Gradually increase rate limit values in production to avoid affecting API response times