Wordpress xmlrpc.php and Spammers – September 18, 2026 (read more)

Spammers love the xmlrpc.php  - I just checked one server, and it has ~60K over the last month, and it is only that small because I block 100% of the hits to them and then my firewall blocks the IP addresses if people try multiple times.  And basically all of those requests are trying to hack into wordpress sites by testing usernames and passwords.

But, the reason for this post is that today I had an actual customer who wanted to use it for a legitimate purpose - he has a 3rd party site that he wants to allow backend access into his site through automated means.