WordPress XML-RPC Pingback DDoS Mitigation (Nginx & Apache)

Block weaponized xmlrpc.php pingback amplifications that turn thousands of remote WordPress blogs into a distributed reflection botnet.

1. Attack Signature & Impact Analysis

Critical (Web Crash)

Attackers abuse the pingback.ping API in xmlrpc.php to force thousands of legitimate WordPress blogs to concurrently fetch your target URL, generating unblockable HTTP floods.

2. Production Hardening Configuration (`/etc/nginx/conf.d/block-xmlrpc.conf`)

Deploy this validated configuration to your production server or reverse proxy:

# Nginx Configuration: Completely drop access to xmlrpc.php
server {
    location = /xmlrpc.php {
        deny all;
        access_log off;
        log_not_found off;
        return 444; # Special Nginx non-standard code: Close connection with zero bytes sent
    }
}

# Apache .htaccess alternative:
# 
# Order Deny,Allow
# Deny from all
#

3. Live Simulation & Rule Verification Command

Execute these commands to verify that traffic is actively mitigated without service downtime:

# Test access to xmlrpc.php (should return empty response or connection closed)
curl -I https://yourdomain.com/xmlrpc.php
# Verify Nginx status code 444 closes connection immediately

4. Common Misconfigurations & Troubleshooting Gotchas

⚠️ Production Caution: If using Jetpack or the official WordPress mobile app, disabling XML-RPC completely will prevent remote publishing. In that case, whitelist Automattic IP ranges only.

5. Best Paired With (Complementary Defense Recipes)

Security engineers implementing this rule frequently deploy these complementary baselines: