Wordpress xmlrpc.php and Spammers – September 18, 2026

Spammers love the xmlrpc.php  - I just checked one server, and it has ~60K over the last month, and it is only that small because I block 100% of the hits to them and then my firewall blocks the IP addresses if people try multiple times.  And basically all of those requests are trying to hack into wordpress sites by testing usernames and passwords.

But, the reason for this post is that today I had an actual customer who wanted to use it for a legitimate purpose - he has a 3rd party site that he wants to allow backend access into his site through automated means.

Unfortunately, there isn't a particularly good way, without writing a custom plugin (which I'll have to consider) which can more finely tune control who is allowed access and who isn't), so I had to disable it for his site completely...

I did have another customer who got hacked recently - he had a developer who had his development computer hacked and then the hacker used that password to gain access to the main server.  The hackers are pretty creative with various methods of leaving their ads and backdoors, etc. to re-gain access even after the password is changed, etc.

Fortunately, they haven't yet figured out a couple things that would make it 100X harder for me to track where they came from and what they did, so I was able to prove that they hadn't wrecked everything and I was able to not have to manually check the entire site and could get the site back up without too much trouble.

Score for this week:
Lime Daley: 1
Spammers: 0