Bots constantly try passwords against wp-login.php and xmlrpc.php. XML-RPC is especially attractive because one request can test hundreds of passwords. Even failed attempts use your account's CPU and can slow the site. These steps cut the noise and make a successful guess practically impossible.
Before you start
- Administrator access to WordPress and cPanel.
- Find out whether anything you use needs XML-RPC (see the table below).
Do you need XML-RPC?
| Feature | Needs XML-RPC? |
|---|---|
| Block editor, REST API, WooCommerce | No |
| WordPress mobile app (older versions) | Sometimes; newer versions use the REST API with application passwords |
| Jetpack | Yes |
| Pingbacks and trackbacks | Yes |
| Some remote publishing or management tools | Check the tool's documentation |
Disable XML-RPC with .htaccess
Blocking the file at server level stops the request before PHP runs, which saves the most resources. Edit .htaccess in the site root via cPanel → Files → File Manager and add above the WordPress block:
<Files xmlrpc.php>
Require all denied
</Files>Test by visiting https://yourdomain.com/xmlrpc.php; you should get a 403 Forbidden page. If you use Jetpack, skip this step and rely on Jetpack's own brute-force protection instead.
Disable XML-RPC with a plugin
If you prefer not to edit files, most security plugins (Wordfence, Solid Security, All-In-One Security) have an option to disable XML-RPC. This still loads PHP for each request, but stops the attack from working.
Limit login attempts
Imunify360 on MdmHost servers already detects and blocks brute-force patterns. Add a WordPress-level limit too: in your security plugin enable login lockouts, for example five failures in 15 minutes locks the IP for an hour. Avoid locking out by username alone, which lets attackers lock out your real admins.
Turn on two-factor authentication
With 2FA a guessed password is useless on its own. Install a plugin such as Two Factor or Wordfence Login Security, enable an authenticator app for every administrator and editor, and save the backup codes somewhere safe.
Add a second password to wp-admin
- Open cPanel → Files → Directory Privacy.
- Navigate to the site folder and click Edit next to
wp-admin. - Tick Password protect this directory, give it a name and click Save.
- Create a user and password under Create User.
Many themes and plugins call wp-admin/admin-ajax.php from the front end. Allow it by adding to wp-admin/.htaccess:
<Files admin-ajax.php>
Require all granted
Satisfy any
</Files>Other quick wins
- Do not use
adminor your domain name as a username. - Stop user enumeration: security plugins can block
/?author=1lookups that reveal usernames. - Use application passwords (Users → Profile → Application Passwords) for tools instead of your main password.
Troubleshooting
- Jetpack disconnects: XML-RPC is blocked; remove the rule.
- Front-end forms or filters break after protecting wp-admin: the
admin-ajax.phpexception is missing. - Locked yourself out: rename the security plugin's folder in File Manager to disable it.
How to tell if you are under attack
Open cPanel → Metrics → Raw Access or Visitors and look for many POST requests to /xmlrpc.php or /wp-login.php from changing IP addresses. A sudden rise in CPU usage in cPanel → Metrics → Resource Usage with no matching rise in real visitors points the same way. After applying the steps above, these requests should either disappear or end in 403 responses that cost almost nothing.