Does WordPress support rate limiting?

WordPress does not include built-in rate limiting. The login page, REST API, XML-RPC, and all other endpoints accept unlimited requests by default. This makes WordPress sites vulnerable to brute-force password attacks, API abuse, and resource exhaustion. You can add rate limiting through security plugins like Wordfence or Limit Login Attempts, web server configuration in nginx or Apache, a CDN like Cloudflare, or custom code using WordPress hooks. Server-level rate limiting is more effective than plugin-based solutions because it blocks requests before they reach PHP. UNPWNED checks bounded externally observable rate-limit signals on tested WordPress paths; it does not prove application-wide enforcement or perform credential attacks.