> For the complete documentation index, see [llms.txt](https://docs.glesys.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.glesys.com/products/compute/guides-for-server-management/protect-yourself-from-a-wordpress-xml-rpc-attack.md).

# Protect yourself from a WordPress XML-RPC attack

***

WordPress is one of the most common blogging and content‑management systems today. It is also a favorite target for attackers, and a typical attack vector is to look for weak passwords on the administrator account. By using the WordPress API, an attacker can try a very large number of passwords in a short period of time.

If many attempts are made against a WordPress site that runs on a less powerful server, problems can quickly arise. Both CPU and memory may become exhausted, causing visitors to lose access to the website.

This guide helps protect you against the vulnerability described above.

The file `xmlrpc.php` is the one most frequently called by attackers. The simplest mitigation is to block access to that file. You can do this by editing your `.htaccess` file and adding the appropriate directives below, depending on which version of Apache you are running.

## Instructions for Apache2 version 2.2

{% code title=".htaccess" %}

```
# BEGIN protect xmlrpc.php
<files xmlrpc.php>
order allow,deny
deny from all
</files>
# END protect xmlrpc.php
```

{% endcode %}

## Instructions for Apache2 version 2.4

{% code title=".htaccess" %}

```
# BEGIN protect xmlrpc.php
<files xmlrpc.php>
Require all denied
</files>
# END protect xmlrpc.php
```

{% endcode %}

## More information and general tips

**Please note** that for the `.htaccess` file to have any effect, the Apache server needs to have `AllowOverride AuthConfig` in the virtual host's configuration. For example, this can look like below:

<pre data-title="Example vhost configuration, AllowOverride is highlighted"><code>&#x3C;VirtualHost *:443>
        ServerName my-test.site
        ServerAdmin webmaster@my-test.site
        DocumentRoot /var/www/my-test.site

        &#x3C;Directory /var/www/my-test.site>
            Options Indexes FollowSymLinks
<strong>            AllowOverride AuthConfig
</strong>            Require all granted
        &#x3C;/Directory>
        
        Include /etc/letsencrypt/options-ssl-apache.conf
        SSLCertificateFile /etc/letsencrypt/live/my-test.site/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/my-test.site/privkey.pem
&#x3C;/VirtualHost>
</code></pre>

**Tip:** There are also several WordPress plugins available for managing XML‑RPC in various ways: <https://wordpress.org/plugins/search/xml+rpc/>