2

I had a previous installation of Wordpress in my server and after a DDOS attack, I blocked the access to the xmlrpc.php file from the .htaccess file:

<Files "xmlrpc.php">
    Order allow,deny
    Deny from all
</Files>

Recently, I uninstalled Wordpress but still have requests to the absent file.

My error.log is full of:

[Tue Dec 06 15:30:20 2016] [error] [client 163.172.160.205] client denied by server configuration: /var/www/myserver.com/xmlrpc.php
[Tue Dec 06 15:30:20 2016] [error] [client 212.47.231.34] client denied by server configuration: /var/www/myserver.com/xmlrpc.php
[Tue Dec 06 15:30:20 2016] [error] [client 163.172.143.0] client denied by server configuration: /var/www/myserver.com/xmlrpc.php
[Tue Dec 06 15:30:20 2016] [error] [client 163.172.161.136] client denied by server configuration: /var/www/myserver.com/xmlrpc.php
[Tue Dec 06 15:30:21 2016] [error] [client 163.172.161.64] client denied by server configuration: /var/www/myserver.com/xmlrpc.php

How should I stop these requests or at least avoid their logging?

Memochipan
  • 327
  • 1
  • 2
  • 11
  • I run my servers behind CloudFlare. I would just add a rule that prevents it passing those requests on to my server. Any CDN should have similar functionality. You may also be able to do something similar on some firewalls. – Tim Dec 06 '16 at 21:47

1 Answers1

1

You should be able to do this easily with fail2ban.

user9517
  • 115,471
  • 20
  • 215
  • 297