aph5

<ul>
<li>XML-RPC Control Dashboard provides WordPress administrators with a way of quickly toggling on/off the XML-RPC functionality.</li>
<li>On initial installation and activation, XML-RPC will be disabled,</li>
<li>It displays the current enabled/disabled status in the dashboard, helping users avoid leaving access on unnecessarily.</li>
<li>It features XML-RPC rate limiting functionality, providing some protection to users while XML-RPC is on.</li>
<li>Rate limiting is on by default, but can be turned off. Note that it’s not perfect security however, and we recommend XML-RPC is disabled after use.</li>
</ul>
<h4>Why Control XML-RPC?</h4>
<p>XML-RPC is a WordPress feature that allows remote access to your site. While useful for legitimate applications like mobile apps and remote publishing, it’s frequently exploited for:</p>
<ul>
<li>Brute force password attacks</li>
<li>DDoS amplification attacks via pingbacks</li>
<li>Spam distribution</li>
<li>Resource exhaustion</li>
</ul>
<h4>Rate Limiting Protection</h4>
<p>When enabled, the plugin automatically limits:</p>
<ul>
<li><strong>Failed Authentication</strong> – Maximum 5 failed login attempts per hour per IP</li>
<li><strong>High-Risk Methods</strong> – Limits on pingback.ping, system.multicall, and other abuse-prone methods</li>
<li><strong>IP Validation</strong> – Prevents IP spoofing by validating addresses and processing proxy headers correctly</li>
</ul>
<h4>Privacy</h4>
<p>This plugin does not collect, store, or transmit any user data outside your WordPress installation. All rate limiting data is stored temporarily using WordPress transients and is automatically cleaned up.</p>
<h3>Additional Information</h3>
<h4>Support</h4>
<p>For support, feature requests, or bug reports, please visit the plugin’s support forum.</p>
<h4>Contributing</h4>
<p>Feedback is welcomed.</p>
<h4>Security</h4>
<p>If you discover a security vulnerability, please report it responsibly via the WordPress security team or directly to the plugin author.</p>


Disable XML-RPC – Dashboard Control

Quickly toggle XML-RPC on/off from your dashboard. Perfect for temporarily enabling access for mobile apps, then securing your site again.

susheelhbti

<p>TrapFlux Request Firewall is a lightweight request firewall that blocks vulnerability scanners and bot floods by <strong>how they behave</strong>, not just where they come from.</p>
<ul>
<li><strong>Behavior-based blocking</strong> — exploit-path probes (<code>.env</code>, <code>wp-config</code> backups, <code>.sql</code> dumps), malicious user agents, and request floods.</li>
<li><strong>Rate limiting</strong> — every visitor is rate limited; hits on exploit paths count double, so scanners get banned far faster than real visitors ever could.</li>
<li><strong>Honeypot traps</strong> — invisible links only bots follow; one visit means a permanent ban.</li>
<li><strong>Subnet bans</strong> — block a whole CIDR range (e.g. <code>20.100.172.0/24</code>) when attackers rotate IPs on cloud providers.</li>
<li><strong>Text attack reports</strong> — one-click downloadable <code>.txt</code> reports (summary + raw log) listing every URL attackers tried to access, ready to hand to your hosting company.</li>
<li><strong>fail2ban-friendly log</strong> — one pipe-delimited line per blocked request, so your host can ban attackers at the network level using the plugin’s detections.</li>
<li><strong>Fails open</strong> — any internal error and your site keeps working normally. An emergency <code>disable.flag</code> file shuts blocking off instantly via FTP.</li>
</ul>
<h4>Strongest mode (optional)</h4>
<p>By default the firewall runs when plugins load — before WP routing, themes and queries. For maximum resource savings you can point PHP’s <code>auto_prepend_file</code> at <code>firewall.php</code> so blocking happens before WordPress loads at all. See the FAQ.</p>
<h4>Honest limitations</h4>
<ul>
<li>This is a request firewall, not a malware scanner — it will not detect an already-infected site.</li>
<li>It ships with rules for today’s common probes and has no cloud threat feed; review the rules occasionally.</li>
<li>The “Block xmlrpc.php” option breaks Jetpack and the WordPress mobile app — disable that single toggle if you use them.</li>
<li>All assets (CSS/JS) are bundled — the plugin makes no external network requests.</li>
</ul>


TrapFlux Request Firewall

Lightweight, behavior-based bot firewall. Blocks scanners before WordPress loads, with text attack reports for your hosting company.

Disable XML-RPC – Dashboard Control vs TrapFlux Request Firewall