📑 Table of ContentsHide / Show
The Two Most Attacked WordPress Endpoints
Over 90% of automated web attacks targeting WordPress focus on two specific files: wp-login.php (for brute-forcing administrator passwords) and xmlrpc.php (for amplification attacks and pingback abuse).
1. Completely Disable XML-RPC
Unless you are using the legacy WordPress mobile app or Jetpack, XML-RPC is completely obsolete in 2026 because the modern WordPress REST API handles all remote interactions securely.
Block access to xmlrpc.php at the web server level via .htaccess (LiteSpeed/Apache):
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>
2. Change or Mask the Default Login URL
Bots scan /wp-login.php and /wp-admin/ millions of times per day. By changing your login slug using plugins like WPS Hide Login or native server rewrite rules, you immediately eliminate 99% of automated credential spraying attempts.
3. Cloudflare Rate Limiting Rule
In Cloudflare WAF, create a free Rate Limiting rule on *wpustaad.com/wp-login.php*. Block any IP address that submits more than 5 requests within a 1-minute window for 1 hour.
⚡ Related WordPress Security & Site Hardening Guides
- WordPress Salt Keys & wp-config.php Hardening Guide – Strengthen cookie hash keys, disable file editing, and lock down config files.
- How to Stop WordPress Spam Comments & Fake Registrations – Block spambots permanently with Turnstile, honeypots, and Akismet.
- Complete Guide to Two-Factor Authentication (2FA) in WordPress – Add authenticator app verification to bulletproof user credentials.
- How to Start a High-Converting WooCommerce Store in 2026 – From hosting and SSL to payment gateways, checkout flows, and catalog setup.
Advanced Rate Limiting & Fail2Ban Protection
Botnets target wp-login.php and xmlrpc.php using distributed IP pools to exhaust PHP worker threads. While plugins can mitigate attacks, server-level rate limiting stops malicious requests before PHP is even spawned, conserving vital CPU and memory resources.
On Nginx, you can establish an isolated connection limit zone in your server block:
# Define login rate limiting zone (1 request per second)
limit_req_zone $binary_remote_addr zone=wplogin:10m rate=1r/s;
location = /wp-login.php {
limit_req zone=wplogin burst=3 nodelay;
include fastcgi_params;
fastcgi_pass unix:/run/php/php8.2-fpm.sock;
}If your setup utilizes Jetpack or the official WordPress mobile app, whitelist Automattic’s published IP ranges in your Web Application Firewall (WAF) to maintain remote publishing without leaving xmlrpc.php exposed to universal credential stuffing.
Frequently Asked Questions
Will disabling XML-RPC break my WordPress site?
No. Modern WordPress core relies on the REST API for almost all background communication. XML-RPC is legacy and only required if you use external desktop clients or specific Jetpack sync services.
How can I identify if my site is currently under a brute-force attack?
High CPU utilization combined with an influx of POST requests toward /wp-login.php or /xmlrpc.php in your server access logs indicates an active credential-stuffing storm.
Does changing the WordPress login URL stop automated bots?
Yes, changing the login slug from wp-login.php to a custom endpoint eliminates 99% of generic automated attack scripts, significantly reducing server resource consumption.