I manage a WordPress website using an virtual machine in the cloud, and lately, I noticed a lot of unwanted requests to the xmlrpc.php component that are slowing down the site causing high CPU loads. If it was for me, I would disable it entirely, but the site uses the JetPack plugin which relies on xmlrpc.
So, my question is: how to allow JetPack access to xmlrpc while blocking everyone else and without disabling xmlrpc on the server?
The site has the bruce for protection enabled with JetPack, and fail2ban is enabled and working, but doesn't seem to fix the problem.
While doing some research, I have found this workaround: https://www.namehero.com/startup/how-to-safely-disable-xmlrpc-in-wordpress-while-keeping-jetpack/ but after applying these settings to the htaccess, it immediately stops unwanted requests, but JetPack gets blocked too. So, it doesn't seem to work as expected, or I'm doing it wrong.
<Files xmlrpc.php> Order allow,deny Allow from 18.104.22.168/22.214.171.124 Deny from all Satisfy All ErrorDocument 403 http://127.0.0.1/ </Files>
Update: These are the IP addresses that WordPress says it's needed for jetpack:
So, the question also is, how do I these IP addresses to the htaccess block above?
126.96.36.199/32 188.8.131.52/32 184.108.40.206/32 220.127.116.11/20 18.104.22.168/20 22.214.171.124/20 126.96.36.199/22 188.8.131.52/32 184.108.40.206/32 220.127.116.11/32 18.104.22.168/32