Stopping an XML-RPC WordPress attack for admins

Stopping an XML-RPC WordPress attack

XML-RPC attacks are among the most common attacks on various WordPress websites. Here you’ll learn what XML-RPC protocol is, what it is used for, what these attacks are, how they happen and how to prevent them. 

What is XML-RPC?

XML-RPC is a remote procedure call protocol that uses HTTP as a transport mechanism and encodes its calls using XML. XML is a language that defines rules for encoding documents and is both human-readable and machine-readable. RPC is a way for a call from one location (device) to trigger the execution of a routine or a function in another location (server). It was created in 1998 and allowed for sending and receiving of encoded, potentially complex, or nested data structures via HTTP requests. 

XML-RPC and its role within WordPress installations

XML-RPC is one of the core WordPress features which allows remote access to otherwise inaccessible sections of the WordPress dashboard. For example, if you wanted to post to your site from a mobile device since your computer wasn’t nearby, you could do that using various third-party applications (Windows Live Writer was one of them). XML-RPC is a protocol that would allow the connection between a remote third-party application and the WordPress installed on your website. There was an option to disable XML-RPC in earlier WordPress versions, but with the release of WordPress mobile applications, this option’s been enabled by default (since WordPress version 3.5). There isn’t a built-in functionality that would allow you to disable XML-RPC.

XML-RPC is a remote procedure call protocol that uses HTTP as a transport mechanism and encodes its calls using XML. XML is a language that defines rules for encoding documents and is both human-readable and machine-readable. RPC is a way for a call from one location (device) to trigger the execution of a routine or a function in another location (server). It was created in 1998 and allowed for sending and receiving of encoded, potentially complex, or nested data structures via HTTP requests. 

Problematic nature of XML-RPC in WordPress

In the past, some RPCs have been exploited. One of the examples would be a massive Microsoft virus known as MSBlast or W32.Blaster.Worm which caused significant chaos on Windows computers, from August 2003. Nowadays, it presents a security risk for XML-RPC attacks on WordPress sites. Randomized passwords and usernames that aren’t the default “admin” user are still a good security practice, but they will not do much good against XML-RPC attacks. Namely, there are two main weaknesses that have been exploited in the past. 

Malicious visitors would use the xmlrpc.php file for brute force attacks that might allow them access to your site. A single command can be effectively used to test hundreds of different passwords. Usually, the primary user that would be exploited is the administrator user with the username “admin”. The xmlrpc.php file allows hackers to bypass the usual security measures to prevent brute force attacks towards the main wp-login.php file. For other ways to avoid compromises on your site, see How can I prevent my site from being compromised?

The second weakness was bringing sites down through a DDoS attack. The pingback WordPress feature allows hackers to simultaneously send pingbacks to thousands of sites. This weakness is a feature of xmlrpc.php that gives hackers an endless supply of different IP addresses to distribute the DDoS attack over.