{"id":4358,"date":"2019-11-09T02:19:36","date_gmt":"2019-11-09T02:19:36","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=4358"},"modified":"2019-11-09T02:33:44","modified_gmt":"2019-11-09T02:33:44","slug":"xmlrpc-php","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/wordpress\/xmlrpc-php","title":{"rendered":"xmlrpc.php"},"content":{"rendered":"

Recently in the server logs I saw lots of attempts to \/xmlrpc.php<\/p>

\/xmlrpc.php is the file used for Pingbacks, so if someone links to my blog , they can add my blog article and WordPress will check in then create a link to the users site. This actually opens up wordpress sites to be used for DOS’ people<\/p>

https:\/\/www.trustwave.com\/en-us\/resources\/blogs\/spiderlabs-blog\/wordpress-xml-rpc-pingback-vulnerability-analysis\/<\/a><\/p>

 <\/p>

You can disable access to this file via updating .htaccess<\/p>

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
<\/Files><\/p>","protected":false},"excerpt":{"rendered":"

Recently in the server logs I saw lots of attempts to \/xmlrpc.php\/xmlrpc.php is the file used for Pingbacks, so if someone links to my blog , they […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[492],"tags":[3081,1130,3080],"class_list":["post-4358","post","type-post","status-publish","format-standard","hentry","category-wordpress","tag-dos","tag-wordpress","tag-xmlrpc-php"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t