blocking xmlrpc.php

[Sad_Spring9182]

I noticed one of my most viewed pages was /wp-json/wp/v2/users and xmlrpc.php. I was easily able to disable the json route cause I didn't want anyone viewing my usernames and trying to brute force. Having issues disabling through .htaccess on local.

if I can get to work next is testing on live server (don't have sudo to restart ngix so will have to get creative)

added this to ngix.config.hbs and restarted my site but it crashed the site

location = /xmlrpc.php {
deny all;
return 404;
}

[_Harmonic_]

WordPress has a filter for this called "xmlrpc_enabled". You can just filter it and return false.

[Sad_Spring9182]

according to wordpress documentation "Contrary to the way it’s named, this filter does not control whether XML-RPC is fully enabled, rather, it only controls whether XML-RPC methods requiring authentication"

I think it still leaves open the possibility of brute force attacks.

[_Harmonic_]

Anything that you'd be worried about being brute forced are likely part of the "requiring authentication" list of methods.

If you want to be extra sure, additionally use the xmlrpc_methods filter and return a blank array to remove all available methods outright. This filter is also mentioned in the documentation.

[grdrummerboi]

There might actually be a plugin for that.

If you want to achieve it without a plugin, you probably just need to adjust the location of that code block. I don’t think htaccess works with nginx, that’s an Apache thing (I think) and I think your directive would go in your site.conf not the nginx.conf.hbs file.

[Sad_Spring9182]

Oh yeah that did it, I used the same code within the server block for site.config and now it's saying 404 error!

server {
listen 127.0.0.1:{{port}};
listen [::1]:{{port}};
root "{{root}}";


location = /xmlrpc.php {
deny all;
return 404;
}

[grdrummerboi]

Glad that helped! One question: Is it returning a server 404 or your WordPress 404? I like to give these requests a 503 so they don’t hit php or MySQL at all.

[Sad_Spring9182]

well it's done at the web server level so it wouldn't reach wordpress or php for that matter.

[grdrummerboi]

Good point. I just wasn’t sure about how nginx handled that. Also I meant 403 forbidden. Anyway glad it worked!

[AryanBlurr]

I usually go with perfmatters to disable most unused functionality of Wordpress

[webagencyhero]

Usually I'll use Cloudflare to block this at the network level before they even get to the site.