htaccess - Attach to wp-login.php and xmlrpc.php

admin管理员组

文章数量:1287878

I am receiving many requests to my wp-login.php and xmlrpc file, now I just set up an htaccess to prevent requests to xmlrpc, but how do you suggest me to block wp-login?

thanks

I am receiving many requests to my wp-login.php and xmlrpc file, now I just set up an htaccess to prevent requests to xmlrpc, but how do you suggest me to block wp-login?

thanks

• htaccess
• security
• wp-login-form
• xml-rpc
• hacks

Share Improve this question edited Oct 4, 2016 at 18:06 sdexp 19522 silver badges1111 bronze badges asked Apr 28, 2016 at 12:02 Sam ProvidesSam Provides 1,19522 gold badges99 silver badges1010 bronze badges 1

• 2 I think I found myself an answer here... codex.wordpress/Brute_Force_Attacks – Sam Provides Commented Apr 28, 2016 at 12:12

Add a comment  | 

3 Answers 3

Sorted by: Reset to default 1

Additionally to using htaccess, you can disable the XML-RPC function by adding the following to your child theme's functions.php:

# Set XML-RPC features to false
add_filter( 'xmlrpc_enabled', '__return_false' );
add_filter( 'pre_option_enable_xmlrpc', '__return_zero' );

Try it to paste in your .htaccess file:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_REFERER} !^http://(.*)?example\ [NC]
RewriteCond %{REQUEST_URI} ^/(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^/(.*)?wp-admin$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Replace example to your domain name.

Actually, I advise to you protection plugin, like iThemes Security. It has the excellent feature: to hide wp-login.php and instead, you can set custom url for login (and hackers cant find that url, of course, if you wont reveal that link in internet).

本文标签： htaccessAttach to wploginphp and xmlrpcphp