Protecting WordPress from XML-RPC Brute Force Attacks

The xmlrpc.php file in WordPress is a legacy API interface that is heavily exploited by botnets to perform massive brute-force password guessing and DDoS attacks. If your server CPU is randomly spiking to 100%, XML-RPC is likely the culprit.

Why XML-RPC is Dangerous

Unlike the standard wp-login.php page where a bot can only guess one password per request, XML-RPC's system.multicall method allows attackers to test thousands of passwords in a single HTTP request, bypassing standard rate limits and exhausting server RAM.

Blocking XML-RPC at the Nginx Level

The most efficient way to stop these attacks is before they ever hit PHP. If you are running Nginx, add the following block to your server configuration:

location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
}

Restart Nginx: sudo systemctl restart nginx. This instantly drops the malicious traffic, returning a 403 Forbidden without consuming PHP processing power.

Blocking via Apache .htaccess

If you are on shared hosting or running Apache, insert this rule into your root .htaccess file:

<Files xmlrpc.php>
    Order Deny,Allow
    Deny from all
</Files>

Disabling XML-RPC is safe for 99% of modern websites (unless you use the legacy Jetpack plugin or the official WordPress mobile app).

---

Need Expert Help?

Constant CPU spikes cost you money and performance. JagaWeb optimizes server configurations for high-traffic sites like Agros Empire. Get our RM5,000 Ownership & Access Review for a deep infrastructure audit, or subscribe to our RM450/month Care Plan for optimized, secure hosting. Contact us today.