I have taken over a website where I work that was developed by a previous employee, it seems that recently this site has been the victim of a string of DDoS attacks through the use of the xmlrpc pingback proven by log entries like this:
18.104.22.168 - - [22/May/2016:06:52:49 +0100] "POST /xmlrpc.php HTTP/1.1" 200 596 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)"
(Obviously this isn't a google bot because there is no reason for google to post to this file.)
I believe there are many solutions to this (This tutorial) but I tend to lean towards just outright blocking access to the file. However I am unsure as to whether this site is actually using the service xmlrpc allows you to use. Is there any particular way I can check if the previous developer has put anything in place to use wordpress xmlrpc functionality? Could I check for functions in specific files/is there anything that screams out to identify the use?
any help with this would be great!
EDIT: Would something like this be helpful?
<FilesMatch "^(xmlrpc\.php)"> Order Deny,Allow # IP address Whitelist Allow from xxx.xxx.xxx.xxx Deny from all </FilesMatch>
If I allow from the ip address of the server would this work for plugins etc or do they all have their own IP address that would need to be added?