Hourly connections to my WordPress site via XMLRPC block my IP on BlueHost because they see many email logins

Question

I currently own a WordPress site in a hosting (BlueHost). On the other hand, I have an application in our offices in .Net. This application, updates WordPress via XMLRPC every 1 hour.

The problem is that my IP is temporarily blocked every day.

I am trying to understand what kind of solution exists to these problems. From the hosting service, they tell me that there are many attempts to login via email. They see it as email, but I know it's via XMLRPC.

1. Is there any way to avoid being taken as SPAM, since it really is not?
2. Is the only solution to make fewer connections? They tell me 3 or 4 per day. I need 24.
3. Is there a solution at the hosting configuration level to be able to put the source IP in a white list?

I guess it must be a fairly common problem, that's why I ask it here. From already thank you very much.

If you need additional information about the way I connect, I can add the source code.

UPDATE

Answer from bluehost:

Thank you for contacting support. We have received your case for your IP getting blocked continuously. This is highly unusual and uncommon for an IP to get listed this much. It seems you're using the xmlrpc.php for logging in this is a common practice that we see malicious attempts from. This is because malicious attempts will try to exploit that file to gain access that they should not. I would highly recommend switching back to a standard login procedure.

UPDATE 2:

Second answer fro hosting:

We are following up on your case regarding your XMLRPC logging. Unfortunately the blocking is due to a Mod Security rule within your shared server. This is a security rule within our Mod Security configurations which cannot be removed in a shared server environment. Essentially we have these Mod Security rules set up to prevent customer's from being vulnerable to exploits which XMLRPC can allow such as: https://null-byte.wonderhowto.com/how-to/gain-control-wordpress-by-exploiting-xml-rpc-0174864/

Answer 1

A little history...

SOURCE

XML-RPC has been enabled as default since WP version 3.5, with XML-RPC support enabled you can post to your WordPress blog using many popular 3rd party Weblog Clients,. Sadly, this is another entry point for hackers to gain access to your website.

Most WordPress administrators don't even use XMLRPC

In fact most webmasters have no idea what that file does and this is why most shared hosts simply block it entirely or restrict it. Hosts that do not block and for website administrators that do not use it then its recommended by the security community simply to block it by doing:

Renaming xmlrpc.php

mv xmlrpc.php randomstring.php

Deleting xmlrpc.php

rm xmlrpc.php

.htaccess Deny

<FilesMatch "xmlrpc.php">
  Order Deny,Allow
    deny from all
</FilesMatch>

But occasionally there are instances when xmlrpc.php is actually helpful but how do you benefit from it but not be attacked at the same time and get around system blocks?

The simplest method is to rename it, you can do this by using the file system method e.g via SFTP, FTP, SSH etc, or use one of several plugins that are available on the WordPress plug-in library.

Most hosts block by filename, so effectively renaming it, will provide you with a workaround and it'll make your site more secure. You should expect a lot of 404 errors in your logs since those bots sniffing will cause that, 404s does not indicate your site is broken, in fact, is confirmation in this case that it's working.

If you prefer you can use the rename method and then use the DENY block mentioned above. You can, of course, get inventive and redirect them to a website with a HUGE page size which could/would cause a lot of poorly made bots to simply crash, e.g:

redirect 301 /xmlrpc.php http://www.example.com/bigpagesize.html