matpluginsofficial

matplugins

<p><strong>MAT Firewall</strong> is a comprehensive WordPress security plugin designed to safeguard your website from malicious traffic, brute force attacks, and unauthorized access. Whether you’re running a small blog, business site, or eCommerce platform, <strong>MAT Firewall</strong> provides robust security while maintaining performance.</p>
<h3>Key Features:</h3>
<ul>
<li><strong>Advanced Firewall Rules</strong> – Block or allow traffic based on IP, country, URI, HTTP methods, and more.</li>
<li><strong>Rate Limiting & Anti-Brute Force</strong> – Set request limits to prevent spam, DDoS attacks, and abusive bot activity.</li>
<li><strong>CDN Integration & Protection</strong> – Secure your site with CDN IP whitelisting and anti-spoofing measures.</li>
<li><strong>Real-Time Monitoring</strong> – View blocked and allowed requests via a detailed security dashboard.</li>
<li><strong>Lightweight & Optimized</strong> – Runs efficiently without slowing down your site.</li>
</ul>
<p>🚀 <strong>Upgrade to MAT Firewall Pro</strong> for <strong>unlimited rules, dynamic blocking, enhanced rate-limiting, and priority support.</strong><br />
🔗 <a href="https://pro.matplugins.com" rel="nofollow ugc">Learn More & Upgrade</a></p>
<h3>Upgrade to MAT Firewall Pro</h3>
<p>Unlock <strong>premium security features</strong> with <strong>MAT Firewall Pro</strong>:<br />
✅ <strong>Unlimited Custom Rules</strong><br />
✅ <strong>Advanced Rate-Limiting & Dynamic Blocking</strong><br />
✅ <strong>Detailed Security Analytics</strong><br />
✅ <strong>Priority Support</strong></p>
<p>🔥 <strong>Upgrade now:</strong> <a href="https://pro.matplugins.com" rel="nofollow ugc">MAT Firewall Pro</a></p>
<h3>License & Copyright</h3>
<p>This plugin is licensed under <strong>GPLv2 or later</strong>.<br />
More details: <a href="https://www.gnu.org/licenses/gpl-2.0.html" rel="nofollow ugc">GNU GPL License</a>.</p>


MAT Firewall

One of the best WordPress firewall plugins

MAT Firewall is a powerful WordPress security plugin that helps protect your website from malicious attacks, brute force attempts, and unauthorized ac …

vavkamil

<h3>XML-RPC Settings</h3>
<p>Configure XML-RPC methods to increase the security of your website:</p>
<h4>Build-in features could be used for malicious purposes and cannot be disabled by default.</h4>
<ul>
<li>Disable GET access
<ul>
<li>XML-RPC API only responds to POST requests. Direct GET access is not needed and can be used to fingerprint websites and use them as XML-RPC zombies in later attacks.</li>
</ul>
</li>
<li>Disable system.multicall
<ul>
<li>system.multicall method can be misused for amplification attacks.</li>
</ul>
</li>
<li>Disable system.listMethods
<ul>
<li>system.listMethods method can be used for verifying attack scope.</li>
</ul>
</li>
</ul>
<h4>Prevent malicious actors from enumerating usernames and credentials.</h4>
<ul>
<li>Disable authenticated methods
<ul>
<li>Methods requiring authentication, such as wp.getUsersBlogs, are often used to brute-force your passwords.</li>
</ul>
</li>
</ul>
<h4>Pingbacks are a helpful feature to discover back-links to your posts but can be misused for DDoS attacks or allow fingerprinting your WP version.</h4>
<ul>
<li>Disable pingbacks
<ul>
<li>Pingbacks are generally safe, but are often used for DDoS attacks via system.multicall.</li>
</ul>
</li>
<li>Remove X-Pingback header
<ul>
<li>If you decide to disable pingbacks, it’s a good practice to remove the X-Pingback header return by your posts.</li>
</ul>
</li>
<li>Hide WordPress version when verifying pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
<li>Hide WordPress version when sending pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
</ul>
<h4>Unnecessary XML-RPC API, leave enabled if you are not sure.</h4>
<ul>
<li>Disable Demo API
<ul>
<li>Remove demo.sayHello and demo.addTwoNumbers methods, as they are not needed.</li>
</ul>
</li>
<li>Disable Blogger API
<ul>
<li>WordPress supports the Blogger XML-RPC API methods.</li>
</ul>
</li>
<li>Disable MetaWeblog API
<ul>
<li>WordPress supports the metaWeblog XML-RPC API.</li>
</ul>
</li>
<li>Disable MovableType API
<ul>
<li>WordPress supports the MovableType XML-RPC API.</li>
</ul>
</li>
</ul>
<h4>If you are using some integrations or WP mobile applications, it might be a good idea to allow XML-RPC only to specific IPs.</h4>
<ul>
<li>Allow XML-RPC only for
<ul>
<li>IP comma separated eg. 192.168.10.242, 192.168.10.241</li>
</ul>
</li>
</ul>
<h4>It is possible to hide a message between the allowed methods when system.listMethods is called (not recommended).</h4>
<ul>
<li>Add message to XML-RPC methods
<ul>
<li>We are hiring! Check jobs.yourdomains.com</li>
</ul>
</li>
</ul>


XML-RPC Settings

Secure your website with the most comprehensive XML-RPC Settings plugin.

MAT Firewall vs XML-RPC Settings