I'm running a php application on a VPS. Recently I started a blog for my app on the same server, using wordpress and nginx.

Everything was running fine, until today server was returning error 502 and extremely slow. After some research, I found out I was having a ton of requests to wordpress xmlrpc.php file, so, yeah, my server is under attack.

I have renamed the file to keep it from being accessed, and installed a security plugin on wordpress, it's ok now, but I'm still receiving a ton of post requests to the nonexistent xmlrpc.php file.

It's the first time I'm dealing with this, my questions are:

  1. Would this repeated traffic to an inexistend file still hurt my server performance or memory?
  2. Is there a way to block it (or setup something that would block it) before reaching nginx?

Any help or insight would be greatly appreciated.

  • I know man, tell me about it. Can't beleive it's almost 2017 and no one has made a decent secure fast flat file cms that's not based on markdown. – raphadko Aug 26 '16 at 1:53
  • 2
    Someone is finally professionalizing the static publishing from WP: strattic.com. Am only surprised it took so long. Playing defense with one's own wordpress is not a hobby activity any more. It will be compromised. Consider using a hosting service's "managed" wordpress, or a proxy waf service like Securi or Cloudflare. – Jonah Benton Aug 26 '16 at 2:52
  • Hi! I'm the founder of Strattic. I know that a lot of developers are sick of WordPress, but the fact is that it's still one of the best options for end users who don't code and need to manage their website's content. Markdown and static site generators are not a solution for non-coders. That's why we created Strattic - to make WordPress less awful, but still allow non-coders to manage their sites as they're used to. In any case, I'd love to hear your feedback, ideas and criticism: miriam@strattic.com. – Miriam Schwab Aug 26 '16 at 7:29
  • 1
    Looking forward to testing it @Miriam – raphadko Aug 26 '16 at 8:21
  • @raph try Ghost. It's not static (but runs happily with SQLite so no need for a MySQL server) but it's quite lightweight, doesn't suffer from feature bloat and has (so far) a good security track record. – André Borie Aug 26 '16 at 12:43
up vote 3 down vote accepted

That happens all the time, on the first moment, identify the ip addresses that are attacking your wordpress and just block it with iptables.

On a second moment, install Fail2Ban, configure it to watch wordpress/apache logs, ssh, and any other kind of log that you think that are useful. Apache have several modules, to make users respect your server and don't flood it with requests.

Also, analyse your wordpress install for vulnerabilities, weak passwords, and analyse the logs to detect any intrusion.

It seems that you don't need the xmlprc.php file at all. Just add the following to the top of your .htaccess file:

# BEGIN block xmlrpc attack
RewriteRule ^xmlrpc\.php$ "http\:\/\/0\.0\.0\.0\/" [R=301,L]
# END block xmlrpc attack 

Unfortunately, I don't remember where exactly I found it.

This will redirect (301) all requests for xmlrpc.php to http://0.0.0.0/ instead.

The above offered solution is good because Fail2Ban will stop bad-requests (except the first one) before they reach your nginx or Apache server.

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.