Compatibility with iThemes Security?

Dear John,

Thank you for your trying and letting me know about XML-RPC.

I read the code of iThemes Security and I found no issue related to the XML-RPC. But I strongly recommend you configure only one or the other to eliminate the waste of resources. Which one should be used depends on your expectation. Here’s my recommendation:

1. Use case 1: If you want to completely disable XML-RPC and do not care about what type of attacks come to your site, then iThemes is better than IGB, because the former will block at HTTP server leve while the latter at PHP level.
2. Use case 2: If you want to disable only pingbacks, then iThemes is the best because IGB doesn’t have such a setting.
3. Use case 3: If you want to allow only pingbacks, I recommend IGB because it blocks them comming from undesired countries and still be able to allow Jetpack and WordPress mobile app.
4. Use case 4: If you want to disable “XML-RPC system.multicall”, then I think both are almost the same. I described the reason in 2.2.3 Release Note.

I hope this helps you. And I appreciate if you let me know your expectation.

Thanks.

Yes, there exist a same relationship between them. But in the case of IGB, a login attempt from undesired countries would be immediately blocked. It’s the same as “Maximum number of login attempts” is zero.

In the case of “login attempts from permitted countries”, both “limiting login attempts by host” and “limiting login attempts by user” have pros and cons. For example, if you have an acount named “john” in your site and someone attempts to login using that name, then you will be locked out. Likewise someone can easily change its host/ip using proxy.

So it’s completely depends on your choice.

Should I set it to 0?

No.

I think it’s good they have the same number. For example, the defautl value of “Max Login Attempts Per Host” in iSec is 5 (while the default value of “Max Login Attempts Per User” is 10). Then “Maximum number of login attempts” in IGB might be 5.

Sory but I wrote the wrong words. They don’t need to be the same number. 10 in IGB is OK because the smallest number (i.e. 7 in iSec) is predominant to limit the login attempts.

Thanks.