Let’s explore the ways to fix WordPress XML-RPC pingback vulnerability which has a potential to cause DDoS attacks. At Bobcares, with our WordPress Support service, we can handle your WordPress issues.

WordPress XML-RPC Pingback Vulnerability

Pingback helps web authors to request notification when somebody links to their documents. Hence it gives a message when other people are talking about the posts. Along with its advantages, there is also a chance of DDoS attacks on the websites.

Pingbacks are enabled in WordPress by default. WordPress uses the XML-RPC interface to enable Pingbacks. A hacker can use this XML-RPC interface to send lots of pingbacks to the site in a short period of time. This overloads the server and initiates DDoS attacks. As a result, it leads to downtime and lower conversion rates.

Pingbacks also have the vulnerability which allows the hackers to reveal the public IP address of a protected WordPress installation and bypass any DNS security. Some malicious softwares can also use pingbacks to check for vulnerable open ports.

If the risks associated with the vulnerability over-weigh the advantages, then we may consider the disabling of the pingback.

Disabling Pingback On WordPress

In this article, we will provide three methods from our Support team to disable pingbacks on WordPress site.

By disabling XML-RPC interface manually

We should edit .htaccess file to disable the incoming XML-RPC requests before they reach WordPress. It’s best to backup the site’s code before the editing. The following steps helps to edit the .htaccess file.

• After the FTP client is connected to the server, locate .htaccess in the site’s root folder. If the root folder doesn’t contain a .htaccess file, we may need to select the client’s Force showing hidden files option.
• Now, open .htaccess in a text editor.
• Then insert the below code:

  <Files xmlrpc.php>
  order deny,allow
  deny from all
  </Files>
• Finally, save the changes. Then try running the web address through the XML-RPC Validator tool to confirm XML-RPC is disabled. In this case, we will see an error message.

By disabling XML-RPC interface using code snippets

Code snippets are a handy way to add a range of functionalities to the website without having to install multiple plugins. We can use the code snippets to reduce the WordPress xml-rpc pingback vulnerability.

• Firstly, activate the Code Snippets plugin.
• Once activated, go to Snippet > Add New.
• Then add the below snippet into the code editor.

  <?php
  //Disable XML-RPC
  add_filter('xmlrpc_enabled', '__return_true');

• Once everything related to snippet is taken care of, click on Activate and check that XML-RPC is disabled using the XML-RPC Validator.

By disabling XML-RPC interface using a plugin

We can use the Disable XML-RPC-API plugin to disable the XML-RPC interface.

• Firstly, install and enable ‘Disable XML-RPC-API’.
• Now disable XML-RPC-API. This will turn off pingbacks. We will also receive a confirmation message. By deactivating the plugin, we can turn XML-RPC back on.

[Need assistance with another query? Get in touch with us.]

Conclusion

In this article, we have briefly explained about the WordPress XML-RPC pingback vulnerability. We also included some of the methods from our Tech team to diable the XML-RPC interface on WordPress.