2

I am fairly new to Wordpress and I recently noted a huge amount of traffic hitting the following:

162.242.170.222 - - [01/Aug/2014:08:18:54 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859
162.242.170.222 - - [01/Aug/2014:08:19:01 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859
162.242.170.222 - - [01/Aug/2014:08:19:01 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859
162.242.170.222 - - [01/Aug/2014:08:19:02 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859
162.242.170.222 - - [01/Aug/2014:08:19:11 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861
162.242.170.222 - - [01/Aug/2014:08:19:13 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861
162.242.170.222 - - [01/Aug/2014:08:19:18 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4861

I blocked the IP address which is a temp solution. Is there a permanent solution to blocking these requests, expecially if I don't need

|improve this question
4

There are plugins for that: e.g. http://wordpress.org/plugins/disable-xml-rpc/

You can also write a filter yourself 

add_filter('xmlrpc_enabled', '__return_false');

You can simply add this code your theme functions.php (located in wp-content/themes/your_theme).

However, you are advised to create a child theme (http://codex.wordpress.org/Theme_Development) so that your modification does not disappear when you update the theme.

Alternatively, you can create your plugin (http://codex.wordpress.org/Writing_a_Plugin) where you will put all your WordPress tweaking.

I also add the following for a better protection:

/**
 * Secure WordPress by removing version
 */
remove_action('wp_head', 'wp_generator');


/**
 * Secure WordPress by hiding login errors
 */
function hide_login_errors($errors) { return 'login error'; }
add_filter('login_errors', 'hide_login_errors', 10, 1);
|improve this answer
  • 2
    Will be nice if you add an explanation where to put the code and the implications of using this method – Mark Kaplun Aug 1 '14 at 14:15
  • Absolutely :) I edited the answer – YaFred Aug 1 '14 at 17:36
  • 2
    Please do not use create_function(). Ever. It is hard to read, and it cannot be stored in an opcache. – fuxia♦ Aug 1 '14 at 17:56
  • what would you suggest ? – YaFred Aug 1 '14 at 18:09
  • Either a separate function or a closure. – fuxia♦ Aug 3 '14 at 1:06
9

If your server is an Apache, you can block access before WordPress is even reached with one line in your .htaccess:

Redirect 403 /xmlrpc.php

You can add another line to keep the response short:

ErrorDocument 403 "no"

That will send a very minimal response (two bytes plus HTTP headers), and it will save your resources for better traffic.

|improve this answer
2

An other way is to put this in your .htaccess file:

<Files "xmlrpc.php">
order allow,deny
deny from all
errordocument 403 /noaccess.html
errordocument 404 /noaccess.html
</Files>
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.