We own a website (outside Salesforce and the code is written in PHP) which calls a third party API and get the response back. And the requirement is to integrate the response to Salesforce after receiving the response. The solution I suggested is after the website receiving the response, it can call the Salesforce REST API and we can implement the REST API at Salesforce side. But the issue is, it seems that the API call from website to SFDC can be hijacked. Though Salesforce has a mechanism only to receive api calls from a certain source, it still doesn't prevent the api call to be hijacked. How can we solve this? And is there a better (more secure) way to build this?
It's not clear from the question the exact security concern you have with the REST API but I believe from comments your concern is that a call to the REST API could be intercepted by someone else, modified, and then submitted.
If that's the concern, I agree with @atulrajguru9 that the more likely security vulnerability is going to come from your PHP server and application than the Salesforce REST API.
Two things to consider:
All calls to the REST API are SSL encrypted which would make it difficult to intercept the API call.
You can lock sessions to the IP where they originated under Setup -> Session Settings -> Lock sessions to the IP address from which they originated.
Is there something that the third party API you're already calling out to provides to security the call that the Salesforce REST API does not?