Block XMLRPC Calls on WordPress from the Host Level

[scottalanmiller]

If you see a lot of web traffic or performance issues with your website, a common attack vector is to utilize the XML-RPC functions. This can be used by some external applications, but is often not used and many people will want to have it disabled. You can manage it via a plugin, which makes it easy for the application admin to handle, but if you simply want to disable it at the host level (accessible to a system administrator instead), then you can simply add this code block to the top of your .htaccess files...

# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
allow from xxx.xxx.xxx.xxx
</Files>

Works on Apache, Nginx, OpenLiteSpeed, LiteSpeed, etc.