8

I have several hosted wordpress blogs, and I've been trying to visit them and they are really slow. I looked at my server logs and I found this

stanfordflipside.com:80 188.138.33.149 - - [17/Aug/2013:17:14:28 -0700] "POST /xmlrpc.php HTTP/1.1" 200 595 "-" "GoogleBot/1.0"
stanfordflipside.com:80 188.138.33.149 - - [17/Aug/2013:17:14:28 -0700] "POST /xmlrpc.php HTTP/1.1" 200 595 "-" "GoogleBot/1.0"
stanfordflipside.com:80 188.138.33.149 - - [17/Aug/2013:17:14:28 -0700] "POST /xmlrpc.php HTTP/1.1" 200 595 "-" "GoogleBot/1.0"
stanfordflipside.com:80 188.138.33.149 - - [17/Aug/2013:17:14:28 -0700] "POST /xmlrpc.php HTTP/1.1" 200 595 "-" "GoogleBot/1.0"
stanfordflipside.com:80 188.138.33.149 - - [17/Aug/2013:17:14:29 -0700] "POST /xmlrpc.php HTTP/1.1" 200 595 "-" "GoogleBot/1.0"
stanfordflipside.com:80 188.138.33.149 - - [17/Aug/2013:17:14:29 -0700] "POST /xmlrpc.php HTTP/1.1" 200 595 "-" "GoogleBot/1.0"
stanfordflipside.com:80 188.138.33.149 - - [17/Aug/2013:17:14:29 -0700] "POST /xmlrpc.php HTTP/1.1" 200 595 "-" "GoogleBot/1.0"
stanfordflipside.com:80 188.138.33.149 - - [17/Aug/2013:17:14:29 -0700] "POST /xmlrpc.php HTTP/1.1" 200 595 "-" "GoogleBot/1.0"
stanfordflipside.com:80 188.138.33.149 - - [17/Aug/2013:17:14:31 -0700] "POST /xmlrpc.php HTTP/1.1" 200 595 "-" "GoogleBot/1.0"
stanfordflipside.com:80 188.138.33.149 - - [17/Aug/2013:17:14:31 -0700] "POST /xmlrpc.php HTTP/1.1" 200 595 "-" "GoogleBot/1.0"
stanfordflipside.com:80 188.138.33.149 - - [17/Aug/2013:17:14:31 -0700] "POST /xmlrpc.php HTTP/1.1" 200 595 "-" "GoogleBot/1.0"

I am getting ~10 hits per second to the file /xmlrpc.php from the GoogleBot to several sites, and this seems to be slowing down the server. I am running

tail -f 

on the log file, and can just see these requests continuing. Does anyone know why this might be happening or what you could do to stop it?

  • 2
    I'd have to look up the IP and addresses but I'd bet that isn't actually Google's crawler, just a (most likely) malicious bot pretending to be. – s_ha_dum Aug 18 '13 at 0:25
  • 1
  • yeah i didnt think it was a googlebot--I guess that wasnt clear in my question. in any case, what do you do about this? should i be blocking ips? – jkeesh Aug 18 '13 at 5:36
6

I would block the IP with iptables if it were me, and if you have that kind of server level access.

You could also disable xmlrpc. Unfortunately, since 3.5 the admin screen option to disable that feature has been removed. A single line of code should disable it though: add_filter( 'xmlrpc_enabled', '__return_false' ); That might save some overhead from the requests, though it won't eliminate all of it.

  • Thanks. I ended up blocking it with iptables, and that seemed to help. – jkeesh Aug 19 '13 at 6:13
5

"Googlebot" has no reason to access xmlrpc.php You could add this to the top of your xmlrpc.php

// Block fake Googlebot
if ( strpos($_SERVER['HTTP_USER_AGENT'], "Googlebot") === true ) { exit(); }

I'm guessing it's a core WordPress file. So it might be annoying to keep this updated. Would be nice if Automattic used Akismet to blacklist these IPs from all WP scripts, everywhere.

Update: I ended up removing permission with chmod 0 xmlrpc.php (see my comments) after a DDoS started to tax my server. In other words, this conditional PHP code might not stop an aggressive attacker from temporarily disabling your blog. In any case, they usually give up pretty fast.

  • Also, if you're a blogger that does not use a separate mobile or desktop blog client application, you do not need xmlrpc.php, and you can safely delete it. In other words, if you write your blog posts inside the WordPress dashboard, on the web, you don't need xmlrpc.php. Lately, xmlrpc.php is really under attack by hackers and personally, I recommend you just delete this file. – PJ Brunet Sep 30 '15 at 3:10
  • To revise my comment above: rather than delete xmlrpc.php, you could "chmod 0" the file and bring it back to life as needed, because you might need xmlrpc.php for certain things, like I vaguely remember you need xmlrpc.php to activate Jetpack. – PJ Brunet Aug 9 '16 at 7:29
  • Thanks for the tip. I just put an exit() at the top of the file since we always use wp-admin to edit pages. I found this a relative weakness on Wordpress that makes me worry of implementing WP for a large organisation. With the xmlrpc disabled I wouldn't have to be worried, right? – Mattijs Nov 28 '16 at 23:50
1

block the IP with iptables:

for ip in $(grep xmlrpc /var/log/apache2/access.log | cut -d' ' -f1 | sort | uniq -c | sort -rn | head -n8 | awk '{print $2}'); do \
iptables -A INPUT -s $ip -j DROP; \
done
  • Would be nice to see some explanation of this shell command. – David Aug 9 '16 at 8:09
  • @David Its kinda presumptuous and clumsy IMO. Essentially what this will do is scan the access.log file and look for any requests to xmlrpc.php. Then it counts up duplicate IP addresses, sorts them from highest to lowest, and returns the top 8 IPs (IPs with the most duplicate requests). For each of these IP addresses, it tells the firewall to drop all traffic from them. On my server, there's a lot more than 8 IPs doing this stuff, and this could also block legit requests, since it doesn't scrutinize who is making it. – tdk2fe Dec 5 '16 at 16:37
0

Had this happen recently and it was killing the server and we're now using fail2ban to mitigate the issue.

Added this config to jail.local:

[apache-xmlrpc]

enabled = true
port = http,https
filter = xmlrpc
logpath = /var/log/apache2/*access.log
maxretry = 30
findtime = 300
bantime = -1

And create the filter in filter.d/apache-xmlrpc.conf:

[Definition]
failregex = ^<HOST> -.*"(GET|POST) .*xmlrpc.php
ignoreregex =

In my case the attacks weren't always coming from googlebot so made the regex a bit more broad but for my purposes there's hardly any good reason for any IP to be hitting xmlrpc 30+ times in 5 minutes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.