Why It Matters

The XML-RPC multicall feature allows attackers to test hundreds of password combinations in a single HTTP request, bypassing standard login rate-limiting controls and overloading server CPU resources.

  • Nginx Endpoint Block: Block access using Nginx directives:
location = /xmlrpc.php {
deny all;
access_log off;
log_not_found off;
}

Apache .htaccess Rule

Deny access using Apache 2.4 configuration:

<Files xmlrpc.php>
Require all denied
</Files>

Alternative Mitigation Strategies

Jetpack and the WordPress mobile apps use XML-RPC. If you rely on them, keep XML-RPC on and use a security plugin to disable the system.multicall method (the part attackers abuse) while keeping standard authentication active.