keithlunt

Most security plugins try to do everything — firewall, blocking, malware scanning, email alerts — and end up bloated, slow, and full of upsells. Attack Monitor does one thing: it watches your site for common attack patterns and quietly logs them, so you always know what’s being thrown at your site. 
What it detects
Brute force login attempts 
XML-RPC abuse (including system.multicall floods) 
User enumeration via ?author= and the REST API 
Admin area probing by unauthenticated visitors 
Path and plugin scanning (phpinfo.php, .env, phpmyadmin, wp-config.php and more) 
SQL injection attempts in URLs and POST data 
XSS attempts in URLs and POST data 
Comment flooding
What you get
A dashboard widget showing this week’s attacks by category at a glance 
A full log page with day / week / 30-day / all-time views 
A bar chart of attack volume over time 
Top attacking IPs ranked by hit count 
Filterable event log with timestamps, IPs, URLs and detail 
Safe IP whitelist — exclude your own monitoring tools, cron jobs or office IP ranges 
CIDR range support (e.g. 192.168.1.0/24) for the whitelist 
A single lightweight database table — nothing else added to your WordPress installation
Philosophy 
Detection and blocking are separate concerns. This plugin handles detection only, leaving you free to choose how you respond — whether that’s Fail2ban, Cloudflare, a companion blocking plugin, or simply reviewing the data. No firewall rules are added, no requests are blocked or slowed down, and no data is sent anywhere outside your own database. 
Ideal for developers, agencies and site owners who want visibility without handing over control to an all-in-one security suite.

Janric Simple Attack Monitor

Lightweight attack detection for WordPress. Logs brute force, XML-RPC abuse, SQL injection, XSS attempts and more. No bloat, no blocking — just data.

Lars Koudal

cleverplugins

Prevent your WordPress site from participating and being a victim of pingback denial of service attacks. After activation the plugin automatically disables XML-RPC. There’s no need to configure anything.
By disabling the XML-RPC pingback you’ll: 
* lower your server CPU usage 
* prevent malicious scripts from using your site to run pingback denial of service attacks 
* prevent malicious scripts to run denial of service attacks on your site via pingback
From sucuri.net:
<blockquote>
Any WordPress site with Pingback enabled (which is on by default) can be used in DDOS attacks against other sites.
</blockquote>
<h4>Learn More</h4>
<ul>
<li><a href="http://wptavern.com/how-to-prevent-wordpress-from-participating-in-pingback-denial-of-service-attacks" rel="nofollow ugc">How To Prevent WordPress From Participating In Pingback Denial of Service Attacks</a> – wptavern.com</li>
<li><a href="http://blog.sucuri.net/2014/03/more-than-162000-wordpress-sites-used-for-distributed-denial-of-service-attack.html" rel="nofollow ugc">More Than 162,000 WordPress Sites Used for Distributed Denial of Service Attack</a> – sucuri.net</li>
<li><a href="http://hackguard.com/xmlrpc-php-ping-backs-hackers-denial-service-attacks" rel="nofollow ugc">xmlrpc.php and Pingbacks and Denial of Service Attacks, Oh My!</a> – hackguard.com</li>
</ul>
<h4>Is Your Site Attacking Others?</h4>
Use <a href="http://labs.sucuri.net/?is-my-wordpress-ddosing" rel="nofollow ugc">Sucuri’s WordPress DDOS Scanner</a> to check if your site is DDOS’ing other websites
<h4>Why Not Just Disable XMLRPC Altogether?</h4>
Yes, you can choose to do that, but if you use popular plugins like JetPack (that use XMLRPC) then those plugins will stop working. That is why this small plugin exists.

Remove & Disable XML-RPC Pingback

Great plugin, super easy to install and just sits there doing it's job. Very light as well, so has no effects that I could see, on site speed or memory usage. Can't think of a reason why you wouldn't be using this to be honest. Thanks for developing it!

Just what I needed

Prevent pingback, XML-RPC and denial of service DDOS attacks by disabling the XML-RPC pingback functionality.

Janric Simple Attack Monitor vs Remove & Disable XML-RPC Pingback