WordPress.org
Get WordPress

Make WordPress Core

Changes between Initial Version and Version 1 of Ticket #21509, comment 20


Ignore:
Timestamp:
10/26/2014 08:00:46 PM (12 years ago)
Author:
andrebron

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #21509, comment 20

    initial v1  
    1 Replying to [comment:19 maxcutler]:
    2 > Replying to [comment:18 andrebron]:
    3 > > Hi all.  More recently there have been concerns about how xml-rpc.php is widely abused for DDOS (also for brute force attacks, but really gonna focus of the DDOS).  A perfectly secured wordpress site with xml-rpc.php enabled can be easily abused to participate in DDOS attacks.
    4 >
    5 > Pingbacks, despite living in the XML-RPC API, have never respected the enabled/disabled option for XML-RPC in the admin.
    6 >
    7 > That option only applies to XML-RPC methods that check user credentials, but pingbacks/trackbacks are anonymous and thus do not fall under that check.
    8 >
    91> There are opportunities for the community to write plugins or better documentation on how to block ping/trackback requests either at the PHP level (e.g., by hooking the `xmlrpc_call` action and `die`ing for these methods) or the web server/proxy level (e.g., nginx or Varnish). But just disabling XML-RPC by default will not help with the DDOS issues.
    102