2

I am receiving many requests to my wp-login.php and xmlrpc file, now I just set up an htaccess to prevent requests to xmlrpc, but how do you suggest me to block wp-login?

thanks

0

Try it to paste in your .htaccess file:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_REFERER} !^http://(.*)?example\.com [NC]
RewriteCond %{REQUEST_URI} ^/(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^/(.*)?wp-admin$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Replace example.com to your domain name.

0

Additionally to using htaccess, you can disable the XML-RPC function by adding the following to your child theme's functions.php:

# Set XML-RPC features to false
add_filter( 'xmlrpc_enabled', '__return_false' );
add_filter( 'pre_option_enable_xmlrpc', '__return_zero' );
0

Actually, I advise to you protection plugin, like iThemes Security. It has the excellent feature: to hide wp-login.php and instead, you can set custom url for login (and hackers cant find that url, of course, if you wont reveal that link in internet).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.