3 ms·
For me, the biggest Wordpress fail, is a file called xmlrpc.php. This file is just a menace and should not exist in the default installation. My first two thin
by drinchev 10y ago
For me, the biggest Wordpress fail, is a file called xmlrpc.php. This file is just a menace and should not exist in the default installation.
My first two things I do when I install a new wordpress server is add this to `.htaccess` :
Redirect 301 /xmlrpc.php http://127.0.0.1
Otherwise you will have a very easy DDoS vector that can bring your website down, immediately after some bot finds out this file exists on your host.
- rmccue 10y agoWordPress 4.7, due in a couple of weeks, includes a brand new REST API which means we can finally start removing some uses of XML-RPC and maybe even someday disable it.
- mtberatwork 10y agoOne of the major issues with XML-RPC functionality in WP is that it's enabled by default and opens up a wide target for brute force attacks[1]. I'm assuming this will not change with their REST API. Let's face it, how many WP sites out there really need POST/PUT/DELETE endpoints to be enabled for their family blog? [1] https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html https://blog.sucuri.net/2015/10/brute-force-amplification-at...
- jermaustin1 10y agoOn a blog network I ran for a few years, I spent a lot of time hardening my xmlrpc. I started by adding a required parameter to every call, and if that parameter didn't exist, it would redirect you to a static HTML page. When that was eventually DDoS-ed (all the sites are on the same giant server), I added the location /xmlrpc.php to the nginx server config that blocked it for anyone not coming through my proxy server.