vavkamil

<h3>XML-RPC Settings</h3>
<p>Configure XML-RPC methods to increase the security of your website:</p>
<h4>Build-in features could be used for malicious purposes and cannot be disabled by default.</h4>
<ul>
<li>Disable GET access
<ul>
<li>XML-RPC API only responds to POST requests. Direct GET access is not needed and can be used to fingerprint websites and use them as XML-RPC zombies in later attacks.</li>
</ul>
</li>
<li>Disable system.multicall
<ul>
<li>system.multicall method can be misused for amplification attacks.</li>
</ul>
</li>
<li>Disable system.listMethods
<ul>
<li>system.listMethods method can be used for verifying attack scope.</li>
</ul>
</li>
</ul>
<h4>Prevent malicious actors from enumerating usernames and credentials.</h4>
<ul>
<li>Disable authenticated methods
<ul>
<li>Methods requiring authentication, such as wp.getUsersBlogs, are often used to brute-force your passwords.</li>
</ul>
</li>
</ul>
<h4>Pingbacks are a helpful feature to discover back-links to your posts but can be misused for DDoS attacks or allow fingerprinting your WP version.</h4>
<ul>
<li>Disable pingbacks
<ul>
<li>Pingbacks are generally safe, but are often used for DDoS attacks via system.multicall.</li>
</ul>
</li>
<li>Remove X-Pingback header
<ul>
<li>If you decide to disable pingbacks, it’s a good practice to remove the X-Pingback header return by your posts.</li>
</ul>
</li>
<li>Hide WordPress version when verifying pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
<li>Hide WordPress version when sending pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
</ul>
<h4>Unnecessary XML-RPC API, leave enabled if you are not sure.</h4>
<ul>
<li>Disable Demo API
<ul>
<li>Remove demo.sayHello and demo.addTwoNumbers methods, as they are not needed.</li>
</ul>
</li>
<li>Disable Blogger API
<ul>
<li>WordPress supports the Blogger XML-RPC API methods.</li>
</ul>
</li>
<li>Disable MetaWeblog API
<ul>
<li>WordPress supports the metaWeblog XML-RPC API.</li>
</ul>
</li>
<li>Disable MovableType API
<ul>
<li>WordPress supports the MovableType XML-RPC API.</li>
</ul>
</li>
</ul>
<h4>If you are using some integrations or WP mobile applications, it might be a good idea to allow XML-RPC only to specific IPs.</h4>
<ul>
<li>Allow XML-RPC only for
<ul>
<li>IP comma separated eg. 192.168.10.242, 192.168.10.241</li>
</ul>
</li>
</ul>
<h4>It is possible to hide a message between the allowed methods when system.listMethods is called (not recommended).</h4>
<ul>
<li>Add message to XML-RPC methods
<ul>
<li>We are hiring! Check jobs.yourdomains.com</li>
</ul>
</li>
</ul>


XML-RPC Settings

Secure your website with the most comprehensive XML-RPC Settings plugin.

ahriad

<p>Turbo Rate Limiter is a powerful yet easy-to-use security plugin that helps protect your WordPress site from various types of abuse by limiting the rate at which visitors can make requests.</p>
<h3>Features</h3>
<ul>
<li><strong>URI-based filtering</strong> – Set rate limits for specific URLs, paths, or patterns</li>
<li><strong>Multiple match types</strong> – Exact match, contains, starts with, ends with, or regex</li>
<li><strong>Flexible time windows</strong> – Configure rate limits per second, minute, or hour</li>
<li><strong>Multiple actions</strong> – Return HTTP 429, redirect to URL, or redirect to page</li>
<li><strong>Test mode</strong> – Preview rate limiting behavior without blocking visitors</li>
<li><strong>Debug panel</strong> – Visual debug panel for administrators</li>
<li><strong>Cloudflare support</strong> – Full IPv4 and IPv6 proxy detection</li>
<li><strong>Localization ready</strong> – Translations available for multiple languages</li>
</ul>
<h3>Use Cases</h3>
<ul>
<li><strong>API protection</strong> – Limit API calls to prevent abuse</li>
<li><strong>Login protection</strong> – Prevent brute force attacks on login pages</li>
<li><strong>Form spam prevention</strong> – Limit form submission rates</li>
<li><strong>Resource protection</strong> – Protect heavy database queries</li>
<li><strong>CDN compatibility</strong> – Works with Cloudflare and other proxies</li>
</ul>
<h3>Arbitrary section</h3>
<h3>Developer API</h3>
<p>Turbo Rate Limiter provides hooks and filters for developers:</p>
<pre><code>// Add trusted proxy IPs
add_filter('turbo_rate_limiter_trusted_proxies', function() {
    return [
        '173.245.48.0/20',
        '2400:cb00::/32',
        // More ranges...
    ];
});

// Access rate limiter instance
$rate_limiter = TURBORL_Rate_Limiter::get_instance();
</code></pre>
<p>For full API documentation, see docs/developer-api.md.</p>


Turbo Rate Limiter

Protect your WordPress site from brute force attacks, API abuse, and DDoS attacks with customizable rate limiting rules.

XML-RPC Settings vs Turbo Rate Limiter