How to prevent xmlrpc.php attacks in wordpress?

Starblazer

Starblazer

Elite Member
Jr. VIP
Joined
Feb 28, 2019
Messages
7,421
Reaction score
7,853
Wordpress has xmlrpc.php vulnerability which lets attackers to do bruteforce, DDOS, port scanning etc. By default, wordpress allows it to let the admins remotely post content to their blogs.

I'm already using wordfence but there are hundreds of attacks every week. Is there any way we can prevent these attacks?
 
Advertise on BHW
Pavan Teja 1 said:
Wordpress has xmlrpc.php vulnerability which lets attackers to do bruteforce, DDOS, port scanning etc. By default, wordpress allows it to let the admins remotely post content to their blogs.

I'm already using wordfence but there are hundreds of attacks every week. Is there any way we can prevent these attacks?
Click to expand...
100s of attacks every week?!! Are you using premium wordfence or free?? And any nulled stuff?
 
set up a firewall at that endpoint to block all requests to it?
 
Add this code in htaccess


# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
allow from 123.123.123.123
</Files>
 
serplord said:
100s of attacks every week?!! Are you using premium wordfence or free?? And any nulled stuff?
Click to expand...
Free wordfence and cloudflare. This is actually a workaround for hackers to do bruteforce. What they do is send passwords directly to wordpress login page and then try to login. The DDOS is also possible with pingbacks feature of wordpress. This is actually a normal feature of wordpress. It doesn't have much effect on my site performance but I just want to know more about it to improve my site security.

Ely said:
Add this code in htaccess


# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
allow from 123.123.123.123
</Files>
Click to expand...
Thanks for the code. I'm using nginx. Is there any workaround without htaccess?
 
Pavan Teja 1 said:
Free wordfence and cloudflare. This is actually a workaround for hackers to do bruteforce. What they do is send passwords directly to wordpress login page and then try to login. The DDOS is also possible with pingbacks feature of wordpress. This is actually a normal feature of wordpress. It doesn't have much effect on my site performance but I just want to know more about it to improve my site security.


Thanks for the code. I'm using nginx. Is there any workaround without htaccess?
Click to expand...

https://www.liquidweb.com/kb/convert-htaccess-rules-nginx-directives/

convert what he has written above to directives.
 
Ely said:
Add this code in htaccess


# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
allow from 123.123.123.123
</Files>
Click to expand...

Might this break certain plugins that use it though? I assume the reason he hasn't disabled it is because he needs it for stuff.
 
I don't think there is a fool proof way to stop ddos. Somebody has to take the hit... E.g. cloudflare. Even if you had some nginx rule applied, the hit will still be there. Yes, it will consume less bandwidth, but the server will still be hit.

If the site you are hosting is earning you money, then look into hosts that have ddos protection (it will still be upto xx gb) built in. They are certainly more expensive than normal ones though.
 
Gogol said:
I don't think there is a fool proof way to stop ddos. Somebody has to take the hit... E.g. cloudflare. Even if you had some nginx rule applied, the hit will still be there. Yes, it will consume less bandwidth, but the server will still be hit.

If the site you are hosting is earning you money, then look into hosts that have ddos protection (it will still be upto xx gb) built in. They are certainly more expensive than normal ones though.
Click to expand...
Mine was a low traffic site without much profit. I've just let it stay online without adding any new posts. As I checked it today, there are 2175 attacks blocked by wordfence this month. I generally don't bother much about security but this made me curious about all the loopholes we ignore. I've disabled XML-RPC authentication in wordfence to prevent these attacks.

I've done some research on these attacks and found that the attackers are adding an xml file to the root directory and redirecting the traffic to ads. I need to study a little more to understand their techniques.
 
Last edited:
Pavan Teja 1 said:
Mine was a low traffic site without much profit. I've just let it stay online without adding any new posts. As I checked it today, there are 2175 attacks blocked by wordfence this month. I generally don't bother much about security but this made me curious about all the loopholes we ignore. I've improved some security settings in wordfence to prevent these attacks. But I'm sure newbies who use easy passwords are vulnerable to such attacks.

I've done some research on these attacks and found that the attackers are adding an xml file to the root directory and redirecting the traffic to ads. I need to study a little more to understand their techniques.
Click to expand...
Yeah, there are certain techniques, which we probably can't discuss here anyway. Your best bait is google search. ddos is completely different though. It's done to make your service offline, rather than hacking your site (there are more complex scenarios which involve both ddos and other attacks at the same time).
 
Pavan Teja 1 said:
Mine was a low traffic site without much profit. I've just let it stay online without adding any new posts. As I checked it today, there are 2175 attacks blocked by wordfence this month. I generally don't bother much about security but this made me curious about all the loopholes we ignore. I've disabled XML-RPC authentication in wordfence to prevent these attacks.

I've done some research on these attacks and found that the attackers are adding an xml file to the root directory and redirecting the traffic to ads. I need to study a little more to understand their techniques.
Click to expand...

gee , means they steal the traffic? I does got hack before. i actually noob on wp , every time come techincal stuff on site. I get services from good bros here help me.

I actually pay wordfrence team to fix my site from hack.

My wordfence paid version going to expire. I got limit budget. I do ask people using free version one ok? A lot claim is do the job is ok.
 
YujinTan said:
gee , means they steal the traffic? I does got hack before. i actually noob on wp , every time come techincal stuff on site. I get services from good bros here help me.

I actually pay wordfrence team to fix my site from hack.

My wordfence paid version going to expire. I got limit budget. I do ask people using free version one ok? A lot claim is do the job is ok.
Click to expand...
Yes, free version is good enough. The free version now offers 2FA & captcha login too. So, it should be fine. You need additional measures to avoid getting hacked, like strong password, firewall, xml-rpc turned off or restricted etc.
 
For making your site secure, I recommend this tools:
On site:
- Wordfence
- WP Cerber
- Ninja Firewall
- All In One WP Security & Firewall

Off-Site:
- Cloudflare (with special added rules)
 
Just disable it... the only reason xmlrpc exists is to allow you to post to your site via mobile... does anyone even do that? there's a free plugin to disable it called Disable XML-RPC by Philip Erb (I can't share link), works a treat.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top