rest_pre_dispatch, and short-circuiting a request cheaply

A rate limit, a maintenance mode or a global authentication check placed inside every route callback is a check repeated forty times; the dispatch filter runs once.

add_filter( 'rest_pre_dispatch', function ( $result, $server, $request ) {
    if ( 0 !== strpos( $request->get_route(), '/turkerdev/' ) ) {
        return $result;
    }

    if ( turkerdev_rate_limit_exceeded( $request ) ) {
        return new WP_Error(
            'rate_limited',
            __( 'Too many requests.', 'turkerdev' ),
            array( 'status' => 429 )
        );
    }

    return $result;
}, 10, 3 );

Returning anything non-null short-circuits the request entirely, so the route callback never runs. Returning $result unchanged is what lets the request continue, and returning null by accident is the mistake that breaks every endpoint at once. Scoping to your own namespace first is not optional — a filter that applies to /wp/v2/ as well will rate-limit the editor.