I just published a small extension (funded by Amnesty International Vlaanderen) to prevent the REST API requests still coming through when the site is in maintenance mode.
The extension is CiviCRM native and the structure is based on the CiviCRM User Framework. However, as I have little to no experience with a CMS other than Drupal, I have only implemented the Drupal module. Would be really great if others could add the same trick for the other CMS's!
- check if API request originated from REST (...