vavkamil

<h3>XML-RPC Settings</h3>
<p>Configure XML-RPC methods to increase the security of your website:</p>
<h4>Build-in features could be used for malicious purposes and cannot be disabled by default.</h4>
<ul>
<li>Disable GET access
<ul>
<li>XML-RPC API only responds to POST requests. Direct GET access is not needed and can be used to fingerprint websites and use them as XML-RPC zombies in later attacks.</li>
</ul>
</li>
<li>Disable system.multicall
<ul>
<li>system.multicall method can be misused for amplification attacks.</li>
</ul>
</li>
<li>Disable system.listMethods
<ul>
<li>system.listMethods method can be used for verifying attack scope.</li>
</ul>
</li>
</ul>
<h4>Prevent malicious actors from enumerating usernames and credentials.</h4>
<ul>
<li>Disable authenticated methods
<ul>
<li>Methods requiring authentication, such as wp.getUsersBlogs, are often used to brute-force your passwords.</li>
</ul>
</li>
</ul>
<h4>Pingbacks are a helpful feature to discover back-links to your posts but can be misused for DDoS attacks or allow fingerprinting your WP version.</h4>
<ul>
<li>Disable pingbacks
<ul>
<li>Pingbacks are generally safe, but are often used for DDoS attacks via system.multicall.</li>
</ul>
</li>
<li>Remove X-Pingback header
<ul>
<li>If you decide to disable pingbacks, it’s a good practice to remove the X-Pingback header return by your posts.</li>
</ul>
</li>
<li>Hide WordPress version when verifying pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
<li>Hide WordPress version when sending pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
</ul>
<h4>Unnecessary XML-RPC API, leave enabled if you are not sure.</h4>
<ul>
<li>Disable Demo API
<ul>
<li>Remove demo.sayHello and demo.addTwoNumbers methods, as they are not needed.</li>
</ul>
</li>
<li>Disable Blogger API
<ul>
<li>WordPress supports the Blogger XML-RPC API methods.</li>
</ul>
</li>
<li>Disable MetaWeblog API
<ul>
<li>WordPress supports the metaWeblog XML-RPC API.</li>
</ul>
</li>
<li>Disable MovableType API
<ul>
<li>WordPress supports the MovableType XML-RPC API.</li>
</ul>
</li>
</ul>
<h4>If you are using some integrations or WP mobile applications, it might be a good idea to allow XML-RPC only to specific IPs.</h4>
<ul>
<li>Allow XML-RPC only for
<ul>
<li>IP comma separated eg. 192.168.10.242, 192.168.10.241</li>
</ul>
</li>
</ul>
<h4>It is possible to hide a message between the allowed methods when system.listMethods is called (not recommended).</h4>
<ul>
<li>Add message to XML-RPC methods
<ul>
<li>We are hiring! Check jobs.yourdomains.com</li>
</ul>
</li>
</ul>


XML-RPC Settings

Secure your website with the most comprehensive XML-RPC Settings plugin.

zzmaster

<p>Plugin WP AntiDDOS prevents DDOS attacks on your website by blocking the frequent requests from one or several related IP addresses. This includes HTTP flood and Password cracking attacks. The plugin stores the data in the MySQL table (MEMORY engine), and that ensures its high performance. We recommend to insert a plugin call into the beginning of the  index.php  file of the WordPress, it will significantly increase its effectiveness, since attack requests will be rejected by plugin  before  WordPress heavy engine connection. You have to do it manually. (see the instructions on the page with plugin’s Configuration)</p>
<h4>How it works</h4>
<p>You are setting two main parameters in the Configuration of the plugin – Hits Limit and Seconds Limit. They specify the maximum number of requests from related IP addresses within a certain time. Plugin conciders IP addresses<br />
 a.b.c.1<br />
 a.b.c.2<br />
 a.b.c.3<br />
 …<br />
 a.b.c.255<br />
 as related, they usually belong to the same LAN, and DDOS attacks are often made from many computers on the local network, because if one computer is infected, the attacker easily can infect others. If the plugin detects that during Seconds Limit from some local network there is more than Hits Limit requests, then excessive requests are blocked – plugin responds by status  503 Service not available  with the code, which reloads the page after a while, which is specified in the plugin Configuration as Delay Time. Limits are specified separately for GET, POST, XHR and Login requests.</p>
<h4>Search engine compatibility</h4>
<p>Sometimes search engines produce enough frequent queries, which can cause blockage by the WP AntiDDOS plugin. However, the plugin does not affect search engine indexation, because a response with status code  502 Service not available  is not a content of a page, but a technical reports on its currently unavailability. In any case, we recommend to use  Crawl-delay directive in you robots.txt  file.</p>
<h4>Custom Query Processing</h4>
<p>WP AntiDDOS plugin can be configured to handling only a certain types of queries. For example, the search queries load the server most significantly, and therefore are often used to attack sites. In the plugin’s Configuration in the GET or POST parameters that activate DDOS check up  text field you can enter POST or GET parameters (blank separated) that identify the requests to be processed by plugin and then set the  Process only requests with following GET / POST parameters  to Yes. For example, s pwd parameters, which is defined in the text box since plugin has installed, identifies the WordPress’ search queries and Login attemts. Please, note, that you have separate setting for Login requests that is usefull for preventing Password Cracking attacks.</p>
<h4>The effectiveness of the plugin</h4>
<p>DDOS attacks are very different both by scale and by the used methods. Being a WordPress plugin, WP AntiDDOS is effective against such attacks as HTTP flood, which affect the WordPress engine. They are technically simple and most commonly used for disabling WordPress websites. Usage of the WP AntiDDOS plugin – good practice for basic protection, which is effective in a large number of cases.</p>


WP AntiDDOS

WP AntiDDOS Plugin prevents DDOS attacks on your website by blocking the frequent requests from one or several related IP addresses.

XML-RPC Settings vs WP AntiDDOS