WordPress is the most popular content management system (CMS) in the world, but its popularity also makes it a frequent target for hackers. Whether it’s brute force attacks, malware injections, or unauthorized login attempts, website security should be a top priority for any WordPress website owner.
Recently, I received an alert from my hosting provider, regarding suspicious login attempts on several domains that were not even hosted on my server. This incident highlighted the importance of securing WordPress websites from potential cyber threats.
In this blog, I’ll share the steps to identify and fix security vulnerabilities, along with how to disable XML-RPC, a known entry point for hackers.
1. Identifying Unauthorized Access or Hacking Attempts
Before securing your website, it’s crucial to check if your site has already been compromised. Here’s how you can investigate:
a. Review Server Logs
Your server logs (access.log and error.log) contain information about website requests. Look for:
- Repeated login attempts to wp-login.php from unknown IPs.
- Requests with suspicious query parameters.
- Unauthorized access to files outside the normal WordPress structure.
To access logs on a typical hosting server:
- Log in to your Server control panel.
- Navigate to Logs and check the latest access logs.
b. Scan for Malware and Unusual Code
Use security plugins to scan your website for malware or unauthorized changes:
- Wordfence – A powerful firewall and malware scanner.
- Sucuri Security – Offers monitoring and malware cleanup.
- iThemes Security – Provides brute-force protection and file integrity checks.
Alternatively, manually inspect your website files and look for:
- Unexpected PHP files in /wp-content/uploads/.
- Malicious code injections such as base64_decode, eval(), or
shell_exec(). - Modified .htaccess or wp-config.php files.
c. Check Database for Unauthorized Changes
Hackers may inject malicious scripts into your database. Run the following checks:
- Look for unknown admin users in the
wp_userstable. - Inspect the
wp_postsandwp_optionstables for strange JavaScript or iframe codes.
2. How to Secure Your WordPress Site
If you haven’t found any major issues but want to prevent future attacks, here are essential security measures:
a. Change All Passwords
Reset the passwords for:
- Your WordPress admin account.
- Your database.
- Your hosting control panel and FTP accounts.
- Any additional admin accounts on your website.
Use strong passwords with a mix of uppercase, lowercase, numbers, and special characters.
b. Enable Two-Factor Authentication (2FA)
- Install a plugin like Google Authenticator or Wordfence Login Security to add an extra layer of protection.
- This requires users to enter a time-based one-time password (OTP) along with their regular login credentials.
c. Restrict wp-login.php Access
To prevent brute-force attacks, restrict access to the WordPress login page by IP.
- Add the following to your .htaccess file: <Files wp-login.php> Order Deny,Allow Deny from all Allow from 123.456.789.0 # Replace with your IP </Files>
Alternatively, use plugins like Limit Login Attempts Reloaded to block repeated failed login attempts.
3. Why You Should Disable XML-RPC in WordPress
What is XML-RPC?
XML-RPC is a remote procedure call (RPC) protocol used in WordPress for:
- Remote publishing via apps or external services.
- Pingbacks and trackbacks.
- API integrations with third-party tools.
Why is XML-RPC a Security Risk?
- Brute Force Attacks: Attackers can use XML-RPC’s multicall function to guess passwords with thousands of attempts in one request.
- DDoS Attacks: Hackers can exploit XML-RPC to amplify denial-of-service (DDoS) attacks.
- Plugin Vulnerabilities: Older or unmaintained plugins may expose security flaws via XML-RPC.
How to Disable XML-RPC
Method 1: Use a Plugin (Easiest Way)
- Install Disable XML-RPC or Wordfence Security.
- Activate the plugin, and XML-RPC will be disabled automatically.
Method 2: Block XML-RPC via .htaccess
Add this code to your .htaccess file:
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>
Method 3: Disable XML-RPC in functions.php
Add this line to your theme’s functions.php file:
add_filter('xmlrpc_enabled', '__return_false');
Method 4: Block XML-RPC via NGINX (for NGINX Servers)
If your server uses NGINX, add this rule to the configuration file:
location = /xmlrpc.php {
deny all;
}
Restart NGINX:
sudo systemctl reload nginx
How to Verify XML-RPC is Disabled
- Open a browser and visit: https://yourwebsite.com/xmlrpc.php
- If disabled, you should see:
- 403 Forbidden
- 404 Not Found
- Or a custom security message
4. Monitor and Maintain Website Security
After implementing these security measures, regularly monitor your website:
- Install a website firewall (e.g., Cloudflare, Sucuri Firewall).
- Schedule daily backups using UpdraftPlus or All-in-One WP Migration.
- Regularly check WordPress security logs for unusual activity.
- Keep WordPress core, themes, and plugins updated.
Final Thoughts
WordPress security is an ongoing process, not a one-time fix. Hackers constantly look for vulnerabilities, so taking proactive steps to secure your website is crucial. Disabling XML-RPC, securing login pages, and monitoring your logs can significantly reduce the risk of attacks.
If you suspect that your WordPress site has been compromised, act quickly by scanning for malware, updating credentials, and restoring a clean backup.
By following these best practices, you can protect your WordPress website from potential threats and keep your online presence secure.
Stay safe and keep your website protected! 🚀