keithlunt

Most security plugins try to do everything — firewall, blocking, malware scanning, email alerts — and end up bloated, slow, and full of upsells. Attack Monitor does one thing: it watches your site for common attack patterns and quietly logs them, so you always know what’s being thrown at your site. 
What it detects
Brute force login attempts 
XML-RPC abuse (including system.multicall floods) 
User enumeration via ?author= and the REST API 
Admin area probing by unauthenticated visitors 
Path and plugin scanning (phpinfo.php, .env, phpmyadmin, wp-config.php and more) 
SQL injection attempts in URLs and POST data 
XSS attempts in URLs and POST data 
Comment flooding
What you get
A dashboard widget showing this week’s attacks by category at a glance 
A full log page with day / week / 30-day / all-time views 
A bar chart of attack volume over time 
Top attacking IPs ranked by hit count 
Filterable event log with timestamps, IPs, URLs and detail 
Safe IP whitelist — exclude your own monitoring tools, cron jobs or office IP ranges 
CIDR range support (e.g. 192.168.1.0/24) for the whitelist 
A single lightweight database table — nothing else added to your WordPress installation
Philosophy 
Detection and blocking are separate concerns. This plugin handles detection only, leaving you free to choose how you respond — whether that’s Fail2ban, Cloudflare, a companion blocking plugin, or simply reviewing the data. No firewall rules are added, no requests are blocked or slowed down, and no data is sent anywhere outside your own database. 
Ideal for developers, agencies and site owners who want visibility without handing over control to an all-in-one security suite.

Janric Simple Attack Monitor

Lightweight attack detection for WordPress. Logs brute force, XML-RPC abuse, SQL injection, XSS attempts and more. No bloat, no blocking — just data.

Max Cutler

This plugin brings XML-RPC API enhancements from the WordPress 3.4 release to previous versions 
of WordPress (3.3 and earlier). It also adds new user management methods.
It is derived from Prasath Nadarajah’s GSoC ’11 project to expand WordPress’ web services, 
although the exposed API methods are not compatible (different parameter names/types/orders).
<h4>Methods</h4>
New Methods:
<ul>
<li>wp.newUser – create a new user</li>
<li>wp.editUser – edit user information</li>
<li>wp.deleteUser – delete a specfic user</li>
</ul>
3.5 Methods for pre-3.5 sites:
<ul>
<li>wp.getUser – get information about a specific user</li>
<li>wp.getUsers – retrieve a list of users</li>
<li>wp.getProfile – retrieve information about the requesting user</li>
<li>wp.editProfile – edit the profile of the requesting user</li>
<li>wp.getRevisions – retrieve revisions for a specific post</li>
<li>wp.restoreRevision – restore a post revision</li>
</ul>
3.4 Methods for pre-3.4 sites:
<ul>
<li>wp.newPost – create a new post (of any post type)</li>
<li>wp.editPost – edit a post (of any post type)</li>
<li>wp.deletePost – delete a post (of any post type)</li>
<li>wp.getPost – get a specific post (of any post type)</li>
<li>wp.getPosts – get a list of posts</li>
<li>wp.getPostType – get information about a specific post type</li>
<li>wp.getPostTypes – get a list of registered post types</li>
<li>wp.getTaxonomy – get information about a specific taxonomy</li>
<li>wp.getTaxonomies – get a list of registered taxonomies</li>
<li>wp.newTerm – create a new term in a taxonomy</li>
<li>wp.editTerm – edit a term in a taxonomy</li>
<li>wp.deleteTerm – delete a term in a taxonomy</li>
<li>wp.getTerm – get information about a specific term in a taxonomy</li>
<li>wp.getTerms – get a list of term associated with a taxonomy</li>
</ul>

XML-RPC Modernization

excelent

This plugin updates the WordPress XML-RPC API to leverage the latest features of WordPress and move beyond the historical Blogger/metaWeblog/MT APIs.

Janric Simple Attack Monitor vs XML-RPC Modernization