My solution:
1. Install and enable plugin “Disable XML-RPC”
2. Rename XML-RPC file in site root so it ceases to exist.
3. Add to .htaccess
<Files xmlrpc.php>
deny from all
</Files>
4. Use country blocking whenever possible.
5. Thank the WordPress developers for their nice little bot attractant known as xmlrpc.php. It’s so kind of them to give us ways to enjoy watching swarms of bots take down our websites.
6. See https://wordpress.org/support/topic/xmlrpcphp-attack-on-wordpress-38?replies=28
MTN
Hi.
Thanks for the answer.
but does disabling XML-RPG broke things such as jetpack plugin and other mobile APP?
is there any other way to solve this?
I have the same problem with about one hundred different IPs each day, WordFence is blocking them with the rules “lock invalid usernames” because they try to login with “test”, but the link they use seems to be poiting to xmlrpc.php .
I’m opening a new thread with more infos.
Hi.
Yes, I could use “lock invalid usernames” but they are not good as real customer can make mistake easily.
Also even If they got blocked with that they are blocked but it is also being logged as well for xmlrpc types of attack.
On my websites, most of attacks are using XMLRPC, sometimes it uses same IPs but so many login requests in very short time. some other cases are trying same user name but different location which I mentioned above.
I think none of security plug-in can block XMLRPC without disabling XMLRPC at the moment.
This is very hard.
Just forget anything the needs XMLRPC. It’s like Flash, excellent idea that is flawed. If stomping on XMLRPC breaks Jetpack, then Jetpack is bogus. We all need to say no to this junk, not spend days defending ourselves against attacks due to some ivory tower developer’s idea about what we “need” out here in the real world. MTN
