Within the company Network and .NET based clients : Use WCF with TCP binding (Fast communication than HTTP)
Outside the company Network, and use diverse technologies like PHP, Python, web UI etc: Use Web API with REST
Security Concern
WCF support WS- standard and SOAP protocal.
Web API is tighly coupled with http, so can only use http releated security measures.
Network languages
WCF support multiple protocols like SOAP, TCP, HTTP, HTTPS, Named Pipe, MSMQ,
Web API supports only http, https
Architecture
WCF can be used to build SOA compliance services due to the nature that it's able to support different protocols.
Web API is mainly used for front end integration, e.g. Web UI because of http protocol.
Message Format
WCF supports more message formats than web api, e.g. binary message formats
Web api supports text based message format e.g. JSON, XML
Speed
WCF offers faster speed than web api when the service and client sits in the same server. We can use tcp protocol to achieve fast message transfer.