My Website Under a xmlrpc.php Attack!

Boy, I sure hope I'm winning.

More on this: http://perishablepress.com/wordpress-xmlrpc-pingback-vulnerability/

Do we need to do anything? Or is your post just FYI?

And here it is again, with Bad Behavior plugin turned back on

Symbiostock Site Under xmlrpc attack with "Bad Behavior Plugin" Installed

Notice how much the system resources were freed up. These attacks are pretty horrific! The spammers are still trying, but now getting a 403 and wasting their resources.

Leo,

Should we install bad behaviour?
I remember you saying it has special settings, any chance of giving some guidance on the settings at all please

Thanks
Mark

The link at the bottom of leo's first post explains the problem and gives you code to add to the bottom of your htaccess file (in root folder).

Quote from: cathyslife stockphotos.com on September 06, 2013, 04:59

The link at the bottom of leo's first post explains the problem and gives you code to add to the bottom of your htaccess file (in root folder).

Or
the link at the bottom of Leo's post gave an explanation if you understand it.  I don't have a clue what it means or which code is applicable and so it is probably safer not to touch anything ?

Totally Agree.
Far too often these discussions are way above my head.

Steve

Wow, I really scared a few people! Got a few personal messages on it.

Don't worry - my servers been up a few years! I'm sure shared hosting watches stuff like that. Its just funny to witness the hacking in the cyber-space-invaders classic arcade setting.

I'd say don't worry about it yet.

The xml-rpc.php file is in your wp folder. It allows a way to post using blogger and pingbacks. Hackers are using it to invade wp sites. This is a very simple explanation, you could google for more details.   If you add the code shown in the article, listed under alternate .htaccess method, to your root .htaccess file, you can prevent the hacking.


Most of this stuff is over my head too, but to me, this one seemed pretty easy to implement.

No offense but it isn't for those of us who aren't really into code.
And just a personal observation - it seems just about everybody who has or is having major issues is messing with code.
My site is working and I'm gonna leave it alone.

steve

+1
As they say, if it works, don't touch it.

The big dilemma is, that sometimes it doesn't work.

Is there any harm in adding that code to the htaccess file? I am not as confident in shared hosting as i used to be.

Don't mess with the .htaccess file! Even if your site appears to be running you can easily run up a 1-gig sized error file as it serves pages on errors for a month straight.

You'll know when your getting targeted! Hosts often babysit shared environments and when your no longer a baby they will ask you politely to scale up, lock down, or leave. They leave dedicated servers alone to the wolves

I have a A LOT to catch up on, but I think I need to make a good security tutorial that people can "set it and forget it". I just have to add it to my never-ending b----list