Restrict access to xmlrpc.php

Question

I am fairly new to Wordpress and I recently noted a huge amount of traffic hitting the following:

162.242.170.222 - - [01/Aug/2014:08:18:54 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859
162.242.170.222 - - [01/Aug/2014:08:19:01 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859
162.242.170.222 - - [01/Aug/2014:08:19:01 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859
162.242.170.222 - - [01/Aug/2014:08:19:02 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859
162.242.170.222 - - [01/Aug/2014:08:19:11 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861
162.242.170.222 - - [01/Aug/2014:08:19:13 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861
162.242.170.222 - - [01/Aug/2014:08:19:18 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861

I blocked the IP address which is a temp solution. Is there a permanent solution to blocking these requests, expecially if I don't need

Answer 1

There are plugins for that: e.g. http://wordpress.org/plugins/disable-xml-rpc/

You can also write a filter yourself

add_filter('xmlrpc_enabled', '__return_false');

You can simply add this code your theme functions.php (located in wp-content/themes/your_theme).

However, you are advised to create a child theme (http://codex.wordpress.org/Theme_Development) so that your modification does not disappear when you update the theme.

Alternatively, you can create your plugin (http://codex.wordpress.org/Writing_a_Plugin) where you will put all your WordPress tweaking.

I also add the following for a better protection:

/**
 * Secure WordPress by removing version
 */
remove_action('wp_head', 'wp_generator');


/**
 * Secure WordPress by hiding login errors
 */
function hide_login_errors($errors) { return 'login error'; }
add_filter('login_errors', 'hide_login_errors', 10, 1);

Answer 2

If your server is an Apache, you can block access before WordPress is even reached with one line in your .htaccess:

Redirect 403 /xmlrpc.php

You can add another line to keep the response short:

ErrorDocument 403 "no"

That will send a very minimal response (two bytes plus HTTP headers), and it will save your resources for better traffic.

Answer 3

An other way is to put this in your .htaccess file:

<Files "xmlrpc.php">
order allow,deny
deny from all
errordocument 403 /noaccess.html
errordocument 404 /noaccess.html
</Files>