Website hacking via wp-json, how to protect?

Question

Burglary protection

Attackers began to change the content of individual records on the site, from under the admin account. Changing passwords didn't make a difference.
when viewing the logs, it was found that all changed records were requests like
104.167.211.60 - - [11/Feb/2017:01:28:23 +0300] "GET //wp-json/wp/v2/posts/ HTTP/ 1.1" 200 136355 "-" "python-requests/2.11.1"
104.167.211.60 - - [11/Feb/2017:01:28:24 +0300] "POST //wp-json/wp/v2/posts/ 2119 HTTP/1.1" 200 960 "-" "python-requests/2.11.1"
104.167.211.60 - - [11/Feb/2017:01:28:26 +0300] "GET /by.htm HTTP/1.1" 404 5463 "-" "python-requests/2.11.1"
I know about disabling the Rest API, and have disabled it for now.
Questions:
How to protect yourself without disabling REST and access only from certain ip

Answer 1

REST API vulnerability