Navigation

	Home Page
	Index
	All Pages

Quick Search
Advanced Search »

Contributor Links

	Create a new Page
	Administration
	File Management
	Login/Logout
	Your Profile

Other Wiki Sections

Software

Protecting Against XMLRPC.PHP Exploits on WordPress Sites

Overview¶

WordPress sites come with an xmlrpc.php file, which tends to be an attack vector. This article describes how to avoid this.

Procedure¶

1. Rename the xmlrpc.php file, which is typically found in /var/www/html.

2. Adjust the Apache configuration — /etc/httpd/conf/httpd.conf — to include the following.

If there is a <VirtualHost> section, it should be included there; otherwise, include it after the <Directory> section.

<Files "xmlrpc.php">
  order allow,deny
  deny from all
</Files>