Disable WordPress XML-RPC

tech-wp-xmlrpc

XML-RPC lets one request try hundreds of passwords through system.multicall, and can be abused for pingback floods. Disable it unless you need it.

Why this matters

XML-RPC is enabled on your WordPress site. It lets an attacker try hundreds of passwords in a single request (system.multicall brute-force) and can be abused for pingback DDoS.

Your stack

Web servers

Nginx Apache

Frameworks

WordPress

Nginx

1 Block xmlrpc.php at the web server level

nginx

location = /xmlrpc.php {
    deny all;
    return 403;
}

WordPress

1 Disable XML-RPC if your site doesn't use it (most modern WordPress sites use the REST API instead)
2 If you need XML-RPC for Jetpack or the WordPress mobile app, restrict access by IP

php

// Add to functions.php to disable XML-RPC entirely
add_filter('xmlrpc_enabled', '__return_false');

Does your app still have this?

Scan your domain