Important Note: Recommended Method to Block XML-RPC
We’ve introduced a new and improved method to block XML-RPC attacks server-wide. The recommended approach is now to use the following command:
cpfence --bulk-disable-wp-xmlrpcThis command completely disables XML-RPC across all listed WordPress sites, returning a 403 Forbidden response to any attempt to access xmlrpc.php. It’s more efficient, server-friendly, and provides a unified solution for managing WordPress security.
For detailed instructions on using this command and other bulk WordPress security features, please visit our updated guide: How to Use Bulk WordPress Security Features in cPFence.
Why is this recommended? The cpfence --bulk-disable-wp-xmlrpc command ensures complete XML-RPC blocking without relying solely on WAF configurations, making it simpler and more robust to secure your WordPress sites.
If your server is experiencing frequent XML-RPC attacks, blocking access to the xmlrpc.php file server-wide is an effective solution. You can block these requests globally and allow specific websites to use XML-RPC only if needed. Follow the steps below to configure this using the cPFence Web Application Firewall (WAF).
Step 1: Block xmlrpc.php Globally
-
Edit the WAF configuration file:
/opt/cpfence/user-config/cpfwaf/whitelist_ols.conf-
Add the following rule to block
xmlrpc.phpglobally:
SecRule REQUEST_URI "@streq /xmlrpc.php" "id:6001,phase:1,deny,status:403,msg:'Blocking access to xmlrpc.php - cPFence'"-
Apply the changes by running the following command:
/opt/cpfence/app/cpfcronThis will block all XML-RPC requests globally across your server.
TIP: Please note, you may still see traffic to xmlrpc.php in tools like top or htop on the server. However, these requests are being blocked with a 403 status and are not consuming server resources.
Step 2: Enable XML-RPC for Specific Websites (Optional)
If certain websites on your server need access to XML-RPC, you can configure the WAF to allow xmlrpc.php for those domains by adding the following rule:
SecRule REQUEST_HEADERS:Host "@streq example.com" "id:6002,phase:1,pass,nolog,ctl:ruleRemoveById=6001"Replace example.com with the actual domain name. Ensure that each rule has a unique ID (e.g., 6003, 6004).
/opt/cpfence/app/cpfcronThis will allow specific domains to bypass the global block while keeping xmlrpc.php disabled for other websites.
Need Further Assistance?
If you encounter any issues or need additional help, feel free to reach out to our support team via your client portal.
