Title: xmlrpc.php access as "test" user
Last modified: September 1, 2016

---

# xmlrpc.php access as "test" user

 *  Resolved [P51Admin](https://wordpress.org/support/users/p51admin/)
 * (@p51admin)
 * [9 years, 11 months ago](https://wordpress.org/support/topic/xmlrpcphp-access-as-test-user/)
 * Hello Everyone;
 * Earlier this afternoon my WordFence started sending me emails about locked out
   attempts to login as the “test” user.
 * In the last few hours I have had close to 1000 attempts from IP addresses around
   the world and the module being accessed is xmlrpc.php.
 * WordFence is saying that the IP address has been blocked and there is no “test”
   user within my site.
 * There are hundreds of IP addresses doing this from around the globe.
 * I am trying to figure out what to do next. I do not just want to sit around while
   hundreds of attempts are made to try and log into my site with this “test” account.
 * I contacted the hosting service and they were really of little service.
 * I am here on the WordFence support forum because it is WordFence that has again
   done it’s job and is warning me of this attack.
 * I just do not know what to do next.
 * Thanks …
 * P51 Admin
 * [https://wordpress.org/plugins/wordfence/](https://wordpress.org/plugins/wordfence/)

Viewing 4 replies - 1 through 4 (of 4 total)

 *  [bluebearmedia](https://wordpress.org/support/users/bluebearmedia/)
 * (@bluebearmedia)
 * [9 years, 11 months ago](https://wordpress.org/support/topic/xmlrpcphp-access-as-test-user/#post-7544164)
 * Try adding the following to your htaccess file in your public root to block xmlrpc
   calls…
 * # Block WordPress xmlrpc.php requests
    <Files xmlrpc.php> order deny,allow deny
   from all </Files> # END block xmlrpc.php requests
 *  Thread Starter [P51Admin](https://wordpress.org/support/users/p51admin/)
 * (@p51admin)
 * [9 years, 11 months ago](https://wordpress.org/support/topic/xmlrpcphp-access-as-test-user/#post-7544167)
 * [@bluebearmedia](https://wordpress.org/support/users/bluebearmedia/)
 * Thanks for your response.
 * I am traveling at the moment but I will try this when I land.
 * At 1500+ plus attempts (lockouts) and still climbing.
 * P51 Admin.
 *  Thread Starter [P51Admin](https://wordpress.org/support/users/p51admin/)
 * (@p51admin)
 * [9 years, 10 months ago](https://wordpress.org/support/topic/xmlrpcphp-access-as-test-user/#post-7544237)
 * Hello Everyone;
 * Things have settled down for the moment.
 * I am going to do a deeper investigation, but at this time WordFence is giving
   me an all clear on website scans.
 * The false login activity has reduced significantly.
 * I would like to figure out how to export WordFence log files so that I can have
   a closer look at what happened.
 * Can someone point me in the right direction for that kind of information?
 * I have also tuned up the WordFence product to be a little more sensitive.
 * I know that this sort of thing likely happens a lot but it is the first time 
   that it happened to me.
 * I will update when I have more specific informaton.
 * P51 Admin.
 *  Thread Starter [P51Admin](https://wordpress.org/support/users/p51admin/)
 * (@p51admin)
 * [9 years, 10 months ago](https://wordpress.org/support/topic/xmlrpcphp-access-as-test-user/#post-7544312)
 * Hello Again Everyone;
 * I am going to mark this as “resolved”
 * This attack came to my attention because of the features built into the WordFence
   product.
 * Upon review of previous access statistics for my site it turns out that this 
   was actually a relatively minor attack.
 * There were only around 2900 account lockouts within the 24 hour period. The thing
   that was different and what concerned me as that the originating IP addresses
   appeared to be many different countries. (In the past there have been 46,000 
   hits from one IP address in a matter of hours.)
 * I will continue to tune my WordFence plugin but I feel that this product has 
   certainly proven to be a worthwhile addition to my site.
 * I will search through the forums for items relating to downloading hard copy 
   of the log file for the live stream data.
 * Thanks again to those who responded ( [@bluebearmedia](https://wordpress.org/support/users/bluebearmedia/))
 * P51 Admin

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘xmlrpc.php access as "test" user’ is closed to new replies.

 * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865)
 * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wordfence/)
 * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/)

 * 4 replies
 * 2 participants
 * Last reply from: [P51Admin](https://wordpress.org/support/users/p51admin/)
 * Last activity: [9 years, 10 months ago](https://wordpress.org/support/topic/xmlrpcphp-access-as-test-user/#post-7544312)
 * Status: resolved