Unable to BAN xmlrpc.php Attacks

  • dineshsunny9

    (@dineshsunny9)


    6 years, 8 months ago

    Hi,
    Here is my php error log,
    https://pastebin.com/8h4qN1hg

    I am using version 7.20 and finding the IP address where the attack is being happened, those IP addresses Ithemes is not blocking them, because the attacks were still happening.

    are there any settings I am missing?
    here are my WordPress tweaks settings.

    View post on imgur.com

    Will be eagerly waiting for your reply, as I am getting a lot of Bruteforce attacks on my digital ocean server. Please help!

    • This topic was modified 6 years, 8 months ago by dineshsunny9.
Viewing 2 replies - 1 through 2 (of 2 total)
  • nlpro

    (@nlpro)

    6 years, 8 months ago

    The entries below clearly indicate requests for xmlrpc.php are denied in the web server layer:

    AH01630: client denied by server configuration: /var/www/html/xmlrpc.php

    POST /xmlrpc.php HTTP/1.1″ 403

    The only way to prevent any xmlrpc.php requests being attempted is to take the server offline (disconnect it from the internet).

    Anyway once the attacking bot figures out its xmlrpc.php brute force requests are being blocked it will move on to another target.

    To prevent any confusion, I’m not iThemes.

    • This reply was modified 6 years, 8 months ago by nlpro.
    beardedginger

    (@beardedginger)

    6 years, 8 months ago

    Hi,

    > as I am getting a lot of Bruteforce attacks on my digital ocean server.

    Although this is not in direct reference to the xmlrpc.php attacks I would like to recommend enforcing strong passwords to help secure your login. You can also use methods such as reCAPTCHA and 2-factor authentication. Both of those options are available to Security Pro customers, but there are other plugins that can serve that purpose if you do not wish to upgrade.

    Thanks!

    Matt
    iThemes.com

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Unable to BAN xmlrpc.php Attacks’ is closed to new replies.