3

I'm running a php application on a VPS. Recently I started a blog for my app on the same server, using wordpress and nginx.

Everything was running fine, until today server was returning error 502 and extremely slow. After some research, I found out I was having a ton of requests to wordpress xmlrpc.php file, so, yeah, my server is under attack.

I have renamed the file to keep it from being accessed, and installed a security plugin on wordpress, it's ok now, but I'm still receiving a ton of post requests to the nonexistent xmlrpc.php file.

It's the first time I'm dealing with this, my questions are:

  1. Would this repeated traffic to an inexistend file still hurt my server performance or memory?
  2. Is there a way to block it (or setup something that would block it) before reaching nginx?

Any help or insight would be greatly appreciated.

Improve this question
5
  • I know man, tell me about it. Can't beleive it's almost 2017 and no one has made a decent secure fast flat file cms that's not based on markdown.
    – sigmaxf
    Aug 26, 2016 at 1:53
  • 2
    Someone is finally professionalizing the static publishing from WP: strattic.com. Am only surprised it took so long. Playing defense with one's own wordpress is not a hobby activity any more. It will be compromised. Consider using a hosting service's "managed" wordpress, or a proxy waf service like Securi or Cloudflare.
    – Jonah Benton
    Aug 26, 2016 at 2:52
  • Hi! I'm the founder of Strattic. I know that a lot of developers are sick of WordPress, but the fact is that it's still one of the best options for end users who don't code and need to manage their website's content. Markdown and static site generators are not a solution for non-coders. That's why we created Strattic - to make WordPress less awful, but still allow non-coders to manage their sites as they're used to. In any case, I'd love to hear your feedback, ideas and criticism: [email protected].
    – Miriam Schwab
    Aug 26, 2016 at 7:29
  • 1
    Looking forward to testing it @Miriam
    – sigmaxf
    Aug 26, 2016 at 8:21
  • @raph try Ghost. It's not static (but runs happily with SQLite so no need for a MySQL server) but it's quite lightweight, doesn't suffer from feature bloat and has (so far) a good security track record.
    – André Borie
    Aug 26, 2016 at 12:43

2 Answers 2

Reset to default
4

That happens all the time, on the first moment, identify the ip addresses that are attacking your wordpress and just block it with iptables.

On a second moment, install Fail2Ban, configure it to watch wordpress/apache logs, ssh, and any other kind of log that you think that are useful. Apache have several modules, to make users respect your server and don't flood it with requests.

Also, analyse your wordpress install for vulnerabilities, weak passwords, and analyse the logs to detect any intrusion.

Improve this answer
1

It seems that you don't need the xmlprc.php file at all. Just add the following to the top of your .htaccess file:

# BEGIN block xmlrpc attack
RewriteRule ^xmlrpc\.php$ "http\:\/\/0\.0\.0\.0\/" [R=301,L]
# END block xmlrpc attack

Unfortunately, I don't remember where exactly I found it.

This will redirect (301) all requests for xmlrpc.php to http://0.0.0.0/ instead.

The above offered solution is good because Fail2Ban will stop bad-requests (except the first one) before they reach your nginx or Apache server.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .