BillEssley
Well-known member
- Joined
- Feb 19, 2013
- Messages
- 358
- Points
- 28
The problem if your site is receiving XML-RPC attacks is not new, but recently a lot of people are attacked in this way. Therefore, if you do not currently need to connect to the WordPress service or external applications, then disable XML-RPC to avoid the risk of attacking in this form.
Ways to limit attacks through XMLRPC
To limit the attack in this form, there is a simple way is block this file by not allow to execute it. Note you should not delete it because it is part of the WordPress source code, which can cause errors or when you update latest version it will be back hence block it is the most optimal way.
Block xmlrpc.php on .htaccess
If you are using a shared hosting or install Apache server, then insert the following into your .htaccess file in the root directory of the website.
Block xmlrpc.php on NGINX
Retart NGINX
Hope that helped!
Ways to limit attacks through XMLRPC
To limit the attack in this form, there is a simple way is block this file by not allow to execute it. Note you should not delete it because it is part of the WordPress source code, which can cause errors or when you update latest version it will be back hence block it is the most optimal way.
Block xmlrpc.php on .htaccess
If you are using a shared hosting or install Apache server, then insert the following into your .htaccess file in the root directory of the website.
Code:
<files xmlrpc.php>
order allow,deny
deny from all
</files>
Code:
location = /xmlrpc.php {
deny all;
access_log off;
log_not_found off;
}
Code:
service nginx restart
