vavkamil

<h3>XML-RPC Settings</h3>
<p>Configure XML-RPC methods to increase the security of your website:</p>
<h4>Build-in features could be used for malicious purposes and cannot be disabled by default.</h4>
<ul>
<li>Disable GET access
<ul>
<li>XML-RPC API only responds to POST requests. Direct GET access is not needed and can be used to fingerprint websites and use them as XML-RPC zombies in later attacks.</li>
</ul>
</li>
<li>Disable system.multicall
<ul>
<li>system.multicall method can be misused for amplification attacks.</li>
</ul>
</li>
<li>Disable system.listMethods
<ul>
<li>system.listMethods method can be used for verifying attack scope.</li>
</ul>
</li>
</ul>
<h4>Prevent malicious actors from enumerating usernames and credentials.</h4>
<ul>
<li>Disable authenticated methods
<ul>
<li>Methods requiring authentication, such as wp.getUsersBlogs, are often used to brute-force your passwords.</li>
</ul>
</li>
</ul>
<h4>Pingbacks are a helpful feature to discover back-links to your posts but can be misused for DDoS attacks or allow fingerprinting your WP version.</h4>
<ul>
<li>Disable pingbacks
<ul>
<li>Pingbacks are generally safe, but are often used for DDoS attacks via system.multicall.</li>
</ul>
</li>
<li>Remove X-Pingback header
<ul>
<li>If you decide to disable pingbacks, it’s a good practice to remove the X-Pingback header return by your posts.</li>
</ul>
</li>
<li>Hide WordPress version when verifying pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
<li>Hide WordPress version when sending pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
</ul>
<h4>Unnecessary XML-RPC API, leave enabled if you are not sure.</h4>
<ul>
<li>Disable Demo API
<ul>
<li>Remove demo.sayHello and demo.addTwoNumbers methods, as they are not needed.</li>
</ul>
</li>
<li>Disable Blogger API
<ul>
<li>WordPress supports the Blogger XML-RPC API methods.</li>
</ul>
</li>
<li>Disable MetaWeblog API
<ul>
<li>WordPress supports the metaWeblog XML-RPC API.</li>
</ul>
</li>
<li>Disable MovableType API
<ul>
<li>WordPress supports the MovableType XML-RPC API.</li>
</ul>
</li>
</ul>
<h4>If you are using some integrations or WP mobile applications, it might be a good idea to allow XML-RPC only to specific IPs.</h4>
<ul>
<li>Allow XML-RPC only for
<ul>
<li>IP comma separated eg. 192.168.10.242, 192.168.10.241</li>
</ul>
</li>
</ul>
<h4>It is possible to hide a message between the allowed methods when system.listMethods is called (not recommended).</h4>
<ul>
<li>Add message to XML-RPC methods
<ul>
<li>We are hiring! Check jobs.yourdomains.com</li>
</ul>
</li>
</ul>


XML-RPC Settings

Secure your website with the most comprehensive XML-RPC Settings plugin.

Pantelis Kaplanoglou

<p>Protect Your Website with Our Anti DDOS / BOT Protection</p>
<p>Details :<br />
Enable this Plugin Only if you are under DDOS/BOT Attacks<br />
We not resolve the DDOS Problem, but we try to limit bad traffic<br />
With our plugin, you’ll be able to secure your website against potential DDOS and BOT attacks.<br />
Visitors will be required to complete a one-time reCAPTCHA verification<br />
That helps to minimize the amount of data transferred between your website and the attacker.<br />
Once the reCAPTCHA check has been passed, visitors will be granted full access to your website content.</p>
<p>Advance :<br />
If you can’t access on wordpress control panel but you still have access with SSH or FTP<br />
You can enable / disable this protection adding in wp-config.php this option<br />
define( ‘ANTI_DDOS_ENABLED’, true );<br />
Above of the line “require_once ABSPATH . ‘wp-settings.php’;”<br />
Protection ignore the checkbox inside the plugin config page</p>
<p>Protect only specified URLs :<br />
If attackers concentrate their efforts on specified URLs, you can secure only those URLs<br />
You can use either the entire URL or a portion of it,<br />
Using the word “product” then protection enabled for all URLs containing this word.<br />
To protect the entire website, leave the URLs field empty.</p>


Anti DDOS/BOT reCAPTCHA Protection

Protect Your Website with Our Anti DDOS / BOT Protection

XML-RPC Settings vs Anti DDOS/BOT reCAPTCHA Protection